Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.6
CVE-2024-40441: Doccano Open Source Annotation Tools and Auto Labeling Module Privilege Escalation
CVE-2024-40441 · published 2 years ago
Summary
An outdated version of Doccano's open source annotation tools and its Auto Labeling Pipeline module allows an attacker to gain higher permissions on the system. This means an attacker could potentially access sensitive information or take control of the system. Update to the latest version to fix this issue.
Original advisory text
An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1.23 allows a remote a...
An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1.23 allows a remote attacker to escalate privileges via the model_attribs parameter.
References
- https://github.com/doccano/auto-labeling-pipeline/releases/tag/v0.1.23 URL
- https://github.com/doccano/doccano/releases/tag/v1.8.4 URL
- https://github.com/gian2dchris/CVEs/tree/main/CVE-2024-40441 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40441... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-40441 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published23 Sep 2024
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta