Skip to content
OpenAdvisories
Critical · 9.8 CVE-2023-43791 EUVD-2023-0107GHSA-f475-x83m-rx5mPYSEC-2023-274

Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens

Published Nov 9, 2023 · Updated Sep 3, 2024 · Assigned by GitHub_M

Description

Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Leak vulnerability to impersonate any account on Label Studio. An attacker could exploit these vulnerabilities to escalate their privileges from a low privilege user to a Django Super Administrator user. The vulnerability was found to affect versions before `1.8.2`, where a patch was introduced.

Affected products

VendorProductAffectedFixed
HumanSignal label-studio <= 1.8.1 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI label-studio < 1.8.2 1.8.2 GHSA-f475-x83m-rx5m

References