Lucene search

GitHub Advisory DatabaseGHSA-GVQV-H7HH-6FCC

HistoryFeb 06, 2024 - 12:30 a.m.

Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance

2024-02-0600:30:28

CWE-312

CWE-522

GitHub Advisory Database

github.com

allegro ai

clearml

passwords

plaintext

mongodb

compromised server

user emails

7.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

7.1 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords.

Affected configurations

Vulners

Node

clearclearmlRange≤1.14.2

CPENameOperatorVersion
clearmlle1.14.2

CPE	Name	Operator	Version
	clearml	le	1.14.2

References

github.com/advisories/GHSA-gvqv-h7hh-6fcc

hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain

nvd.nist.gov/vuln/detail/CVE-2024-24595

7.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

7.1 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

Related for GHSA-GVQV-H7HH-6FCC