Lucene search

6f8de1f0-f67e-45a6-b68f-98777fdb759cCVE-2024-24594

HistoryFeb 06, 2024 - 3:15 p.m.

CVE-2024-24594

2024-02-0615:15:10

CWE-79

6f8de1f0-f67e-45a6-b68f-98777fdb759c

web.nvd.nist.gov

cve-2024-24594

xss

vulnerability

allegro ai

clearml

web server

security

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

20.4%

JSON

A cross-site scripting (XSS) vulnerability in all versions of the web server component of Allegro AI’s ClearML platform allows a remote attacker to execute a JavaScript payload when a user views the Debug Samples tab in the web UI.

Affected configurations

NVD

Node

clearclearmlMatch-

CPENameOperatorVersion
clear:clearmlclear clearmleq-

CPE	Name	Operator	Version
clear:clearml	clear clearml	eq	-

CNA Affected

[
  {
    "defaultStatus": "affected",
    "packageName": "clearml-web",
    "product": "ClearML",
    "repo": "https://github.com/allegroai/clearml-web",
    "vendor": "Allegro.AI",
    "versions": [
      {
        "lessThanOrEqual": "*",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

20.4%

JSON

Related for CVE-2024-24594