CVE-2023-43791
2 advisories.
PyPI/label-studio CVE-2023-43791: critical 9.8, EPSS 1.24%
Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens
Action: Upgrade label-studio to 1.8.2 or later.
pip install label-studio==1.8.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.8.2 | - |
Fixed versions
| 1.8.2 |
Sources
- osv: GHSA-f475-x83m-rx5m
- https://github.com/HumanSignal/label-studio/security/advisories/GHSA-f475-x83m-rx5m
- https://nvd.nist.gov/vuln/detail/CVE-2023-43791
- https://github.com/HumanSignal/label-studio/pull/4690
- https://github.com/HumanSignal/label-studio/commit/3d06c5131c15600621e08b06f07d976887cde81b
- https://github.com/HumanSignal/label-studio
- https://github.com/HumanSignal/label-studio/releases/tag/1.8.2
- https://github.com/pypa/advisory-database/tree/main/vulns/label-studio/PYSEC-2023-274.yaml
CVE-2023-43791 · published · modified · JSON
PyPI/label-studio CVE-2023-43791: high 8.8, EPSS 1.24%
Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Leak vulnerability to impersonate any accoun
Action: Upgrade label-studio to 1.8.2 or later.
pip install label-studio==1.8.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.8.2 | - |
Fixed versions
| 1.8.2 |
Sources
- osv: PYSEC-2023-274
- https://github.com/HumanSignal/label-studio/security/advisories/GHSA-f475-x83m-rx5m
- https://github.com/HumanSignal/label-studio/pull/4690
- https://github.com/HumanSignal/label-studio/commit/3d06c5131c15600621e08b06f07d976887cde81b
- https://github.com/HumanSignal/label-studio/releases/tag/1.8.2
CVE-2023-43791 · published · modified · JSON