CVE-2024-47064 - CVE House
Back to Database
Status published Medium CVE-2024-47064

Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints

Vulnerability Description

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. If an attacker can trick a logged-in CVAT user into visiting a maliciously-constructed URL, they can initiate any API calls on that user's behalf. This gives the attacker temporary access to all data that the victim user has access to. Upgrade to CVAT 2.19.0 or a later version to fix this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-47064

Credits & Attribution

No credits recorded in the NVD database.

References

More from cvat-ai

View All →
CVE-2025-68430
CVAT vulnerable to directory traversal via mounted share listing
Medium 5.3
CVE-2025-64485
CVAT: Mounted share file overwrite via crafted request
Medium 5.3
CVE-2025-54573
CVAT vulnerable to email verification bypass by use of basic authentication
Medium 4.3
CVE-2025-49135
CVAT missing validation for in-progress backup upload names
Medium 5.3
CVE-2025-48381
CVAT has information disclosure via browsable API
Medium 5.3

Affected Vendor

Affected Software

cvat
Vulnerable Versions:
>= 2.16.0, < 2.19.0

Timeline

Official Publish: September 30th, 2024
Last Modified: September 30th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-79 CWE-81

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact