PT-2023-32775 · Allegro Ai · Allegroai/Clearml-Server

Published 2023-12-18 · Updated 2024-02-08 · CVE-2023-6778

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions allegroai/clearml-server versions prior to 1.13.0

Description The issue is related to Cross-site Scripting (XSS) - Stored, which affects the ClearML Open Source Server. This server is not designed for public use and should be placed behind a company firewall or VPN. The vulnerability can only be exploited by malicious parties with access to the internal network and a user's ClearML login credentials.

Recommendations For versions prior to 1.13.0, update to version 1.13.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the ClearML Open Source Server to minimize the risk of exploitation, ensuring it is placed behind a company firewall or VPN.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-6778

Affected Products

Allegroai/Clearml-Server

References · 6

• 🔥 https://huntr.com/bounties/5f3fffac-0358-48e6-a500-81bac13e0e2b · Exploit
• https://github.com/allegroai/clearml-server/commit/4684fd5b74af582c894b67a0a06e865c948b763a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-6778 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6778 · Vendor Advisory
• https://t.me/cvenotify/63927 · Telegram Post
• https://twitter.com/cracbot/status/1737196576987033730 · Twitter Post