漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
CVAT vulnerable to privilege escalation of users with staff status
Vulnerability Description
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0, users that have the staff status may freely change their permissions, including giving themselves superuser status and joining the admin group, which gives them full access to the data in the CVAT instance. Version 2.55.0 fixes the issue. As a workaround, review the list of users with staff status and revoke it from any users that are not expected to have superuser privileges.
CVSS Information
N/A
Vulnerability Type
特权定义了不安全动作
Vulnerability Title
CVAT.ai CVAT 安全漏洞
Vulnerability Description
CVAT.ai CVAT是CVAT.ai开源的一个数据处理工具。 CVAT.ai CVAT 2.54.0及之前版本存在安全漏洞，该漏洞源于具有staff状态的用户可以自由更改自身权限，可能导致权限提升。
CVSS Information
N/A
Vulnerability Type
N/A