PT-2025-12279 · Polyaxon · Polyaxon

Publicado 2025-03-20 · Atualizado 2025-03-20 · CVE-2024-9365

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions polyaxon/polyaxon version 2.4.0

Description A Cross-Site Request Forgery (CSRF) issue allows attackers to perform unauthorized actions in the context of the victim's browser, including creating projects, model versions, and artifact versions, or changing settings. The impact of this issue includes potential data loss and service disruption.

Recommendations For polyaxon/polyaxon version 2.4.0, consider disabling the affected functionality until a patch is available. Restrict access to sensitive operations, such as project creation and configuration changes, to minimize the risk of exploitation. Avoid using the vulnerable version for critical operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2024-9365

Produtos afetados

Polyaxon

Referências · 3

• https://huntr.com/bounties/cdfa012b-a694-4beb-9a9a-12a9dde07ef9 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2024-9365 · Nota de Segurança
• https://twitter.com/CVEnew/status/1902671077936971823 · Publicação no Twitter