CVE-2024-24593
Last modified
CVE-2024-24593 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. A cross-site request forgery (CSRF) vulnerability in all versions up to 1.14.1 of the api server component of Allegro AI’s ClearML platform allows a remote attacker to impersonate a user by sending API requests via maliciously crafted html. Exploitation of the vulnerability allows an attacker to compromise confidential workspaces and files, leak sensitive information, and target instances of the ClearML platform within closed off networks. . EPSS estimates a 0.38% chance of exploitation in the next 30 days.
Description
A cross-site request forgery (CSRF) vulnerability in all versions up to 1.14.1 of the api server component of Allegro AI’s ClearML platform allows a remote attacker to impersonate a user by sending API requests via maliciously crafted html. Exploitation of the vulnerability allows an attacker to compromise confidential workspaces and files, leak sensitive information, and target instances of the ClearML platform within closed off networks.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Clear | Clearml | <= 1.14.1 |
References
- https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/Exploit, Technical Description, Third Party Advisory
- https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/Exploit, Technical Description, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-24593?
How severe is CVE-2024-24593?
How do I fix CVE-2024-24593?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-24583Multiple out-of-bounds read vulnerabilities exist in the rea…4.3
- CVE-2024-24584Multiple out-of-bounds read vulnerabilities exist in the rea…4.3
- CVE-2024-2459The UX Flat plugin for WordPress is vulnerable to Stored Cro…7.4
- CVE-2024-24590Deserialization of untrusted data can occur in versions 0.17…8.8
- CVE-2024-24591A path traversal vulnerability in versions 1.4.0 to 1.14.1 o…8.8
- CVE-2024-24592Lack of authentication in all versions of the fileserver com…9.8
- CVE-2024-24594A cross-site scripting (XSS) vulnerability in all versions o…5.4
- CVE-2024-24595Allegro AI’s open-source version of ClearML stores passwords…7.1
- CVE-2024-2460The GamiPress – Button plugin for WordPress is vulnerable to…5.4
- CVE-2024-2461If exploited an attacker could traverse the file system to a…6.9
- CVE-2024-2462Allow attackers to intercept or falsify data exchanges betwe…6.8
- CVE-2024-24621Softaculous Webuzo contains an authentication bypass vulnera…9.8
Are you affected by CVE-2024-24593?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST