2 lines
5.7 KiB
JSON
2 lines
5.7 KiB
JSON
{"affected":[{"affectedData":[{"modules":["PT File Handler"],"product":"label-studio-ml-backend","vendor":"HumanSignal","versions":[{"status":"affected","version":"9fb7f4aa186612806af2becfb621f6ed8d9fdbaf"}]}],"source":"cna@vuldb.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:humansignal:label_studio_ml_backend:*:*:*:*:*:*:*:*","matchCriteriaId":"CB69F1C9-D441-4CF1-ADE2-C0630C3E8C84","versionEndIncluding":"2024-09-30","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problematic. Affected by this vulnerability is the function load of the file label-studio-ml-backend/label_studio_ml/examples/yolo/utils/neural_nets.py of the component PT File Handler. The manipulation of the argument path leads to deserialization. An attack has to be approached locally. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available."},{"lang":"es","value":"Se ha detectado una vulnerabilidad en HumanSignal label-studio-ml-backend hasta 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf, clasificada como problemática. Esta vulnerabilidad afecta la función de carga del archivo label-studio-ml-backend/label_studio_ml/examples/yolo/utils/neural_nets.py del componente PT File Handler. La manipulación de la ruta de argumentos provoca la deserialización. Un ataque debe abordarse localmente. Este producto utiliza el enfoque de lanzamiento continuo para garantizar una entrega continua. Por lo tanto, no se dispone de información sobre las versiones afectadas ni sobre las actualizadas."}],"id":"CVE-2025-5173","lastModified":"2026-06-17T09:47:23.160","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"LOCAL","authentication":"SINGLE","availabilityImpact":"PARTIAL","baseScore":4.3,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:L/AC:L/Au:S/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":3.1,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.4,"source":"cna@vuldb.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-5173","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-05-27T17:36:50.889898Z","version":"2.0.3"}}]},"published":"2025-05-26T07:15:26.137","references":[{"source":"cna@vuldb.com","tags":["Issue Tracking","Vendor Advisory"],"url":"https://github.com/HumanSignal/label-studio-ml-backend/issues/765"},{"source":"cna@vuldb.com","tags":["Permissions Required","VDB Entry"],"url":"https://vuldb.com/?ctiid.310261"},{"source":"cna@vuldb.com","tags":["Third Party Advisory","VDB Entry"],"url":"https://vuldb.com/?id.310261"},{"source":"cna@vuldb.com","tags":["Third Party Advisory","VDB Entry"],"url":"https://vuldb.com/?submit.578126"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-502"}],"source":"cna@vuldb.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-502"}],"source":"nvd@nist.gov","type":"Primary"}]}
|