SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2022-36551

A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system.

EXPLOITMEDIUM 6.5EPSS 6.89%

Does this matter?

A public exploit is published in Exploit-DB, so the technical barrier is gone even though the severity is medium and EPSS is 6.9%. Treat it as high on anything reachable from the internet.

Description

A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in these versions of Label Studio enabling a remote attacker to create a new account and then exploit the SSRF.

CVSS 3.1
6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
6.89% probability · 94th percentile
Public exploits
1 in Exploit-DB · first 28 March 2023
CISA KEV
Not listed
Weakness
CWE-918
Affected
heartex/label studio
Source
cve@mitre.org
EPSS trend
0%5%10%30 September 2026: 6.73%26 October 2026: 6.89%30 September 202626 October 2026

EPSS moved from 6.7% on 30 September 2026 to 6.9% on 26 October 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.

Public exploits (1)

Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.

EDB-IDTitleTypePublishedVerified
EDB-51109source ↗Label Studio 1.5.0 - Authenticated Server Side Request Forgery (SSRF)python · Ryan Smithwebapps28 March 2023no

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.