CVE-2023-47117

CVE-2023-47117 is a high-severity information disclosure vulnerability affecting all versions of Label Studio prior to 1.9.2post0. An unauthenticated attacker can exploit a flaw in the application's task filtering mechanism, leveraging Django's ORM, to leak sensitive data character by character from all user accounts. This includes the ability to obtain password hashes, which, combined with a hardcoded secret key, allows for session token forgery. The vulnerability has a CVSS score of 7.5 (HIGH) due to its network-based attack vector and high confidentiality impact. While there is no evidence of active exploitation or public Metasploit/ExploitDB modules, Nuclei templates exist, and the vulnerability has a high EPSS score, indicating a significant likelihood of exploitation.