CVE-2024-40442: Code Injection

Published Sep 23, 2024

Updated

An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1.23 allows a remote attacker to escalate privileges via a crafted REST Request.

Affected Software

2 affected components

Doccano Doccano

Doccano Doccano Auto Labeling Pipeline

Event History

Sep 23, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-40442?

CVE-2024-40442 is classified as a high severity vulnerability due to its potential for privilege escalation.

How do I fix CVE-2024-40442?

To fix CVE-2024-40442, update Doccano to version 1.8.4 or later and Doccano Auto Labeling Pipeline to version 0.1.23 or later.

Who is affected by CVE-2024-40442?

CVE-2024-40442 affects users of Doccano version 1.8.4 and Doccano Auto Labeling Pipeline version 0.1.23.

What types of attacks are possible with CVE-2024-40442?

CVE-2024-40442 allows remote attackers to escalate privileges through specially crafted REST requests.

Is there a workaround for CVE-2024-40442?

There are no documented workarounds for CVE-2024-40442 aside from applying the available security updates.