CVE-2024-24593
Assigner: HiddenLayer
Published: 2024-02-06T14:41:44.470Z
State: PUBLISHED
affected: defaultStatus: unaffected
packageName: clearml-server
product: ClearML
repo: https://github.com/allegroai/clearml-server
vendor: Allegro.AI
versions: lessThan: 1.14.2
status: affected
version: 0
versionType: custom
datePublic: 2024-02-06T15:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: <span style="background-color: rgb(255, 255, 255);">A cross-site request forgery (CSRF) vulnerability in all versions up to 1.14.1 of the api server component of Allegro AI’s ClearML platform allows a remote attacker to impersonate a user by sending API requests via maliciously crafted html. Exploitation of the vulnerability allows an attacker to compromise confidential workspaces and files, leak sensitive information, and target instances of the ClearML platform within closed off networks.</span><br>
value: A cross-site request forgery (CSRF) vulnerability in all versions up to 1.14.1 of the api server component of Allegro AI’s ClearML platform allows a remote attacker to impersonate a user by sending API requests via maliciously crafted html. Exploitation of the vulnerability allows an attacker to compromise confidential workspaces and files, leak sensitive information, and target instances of the ClearML platform within closed off networks.

impacts: capecId: CAPEC-62
descriptions: value: CAPEC-62 Cross Site Request Forgery
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
type: CWE
source: discovery: UNKNOWN
x_generator: engine: Vulnogram 0.1.0-dev