An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1....
Date: 2024-09
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2024-40441
CVE-2024-40442
CWE: CWE-918
CWE-94
CVSS: 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)

An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1.23 allows a remote attacker to escalate privileges via the model_attribs parameter.


Mitigations:

Architectural layers (MAESTRO):