Lucene search

GoogleOSV:GHSA-GVQV-H7HH-6FCC

HistoryFeb 06, 2024 - 12:30 a.m.

Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance

2024-02-0600:30:28

Google

osv.dev

allegro ai

clearml

mongodb

credentials

plaintext

compromised server

user emails

7.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

7.1 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords.

CPENameOperatorVersion
clearmleq1.1.3rc0
clearmleq0.17.5rc3
clearmleq1.14.2rc0
clearmleq0.17.5rc0
clearmleq1.6.1
clearmleq1.14.1rc0
clearmleq1.12.1rc0
clearmleq1.4.1rc0
clearmleq1.11.2rc0
clearmleq1.8.4rc2

Name	Operator	Version
clearml	eq	1.1.3rc0
clearml	eq	0.17.5rc3
clearml	eq	1.14.2rc0
clearml	eq	0.17.5rc0
clearml	eq	1.6.1
clearml	eq	1.14.1rc0
clearml	eq	1.12.1rc0
clearml	eq	1.4.1rc0
clearml	eq	1.11.2rc0
clearml	eq	1.8.4rc2

Rows per page:

1-10 of 1481

References

github.com/allegroai/clearml

hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain

nvd.nist.gov/vuln/detail/CVE-2024-24595

7.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

7.1 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

Related for OSV:GHSA-GVQV-H7HH-6FCC