Server-side Request Forgery (SSRF) Affecting doccano package, versions [0,]
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.06% (28th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-DOCCANO-8073023
- published 24 Sep 2024
- disclosed 23 Sep 2024
- credit Unknown
Introduced: 23 Sep 2024
CVE-2024-40441 Open this link in a new tabHow to fix?
There is no fixed version for doccano.
Overview
doccano is a text annotation tool for machine learning practitioners.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the model_attribs parameter on the request-testing endpoint. An admin user who can send a request that gets a valid JSON response can escalate privileges.