PT-2024-20473 · Allegro Ai · Clearml

Published 2024-02-06 · Updated 2024-02-15 · CVE-2024-24591

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Allegro AI's ClearML platform versions 1.4.0 through 1.14.1

Description A path traversal vulnerability in the client SDK of Allegro AI's ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary location on an end user's system when interacted with.

Recommendations For versions 1.4.0 through 1.14.1, consider restricting access to the dataset upload feature until a patch is available. As a temporary workaround, avoid interacting with maliciously uploaded datasets to minimize the risk of exploitation. Restrict write access to sensitive locations on the end user's system to prevent arbitrary file writing.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-24591

GHSA-M95H-P4GG-WFW3

Affected Products

Clearml

References · 10

• 🔥 https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-24591 · Security Note
• https://osv.dev/vulnerability/GHSA-m95h-p4gg-wfw3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-24591 · Vendor Advisory
• https://github.com/allegroai/clearml · Note
• https://twitter.com/CVEnew/status/1754880741547102233 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1754925368178336248 · Twitter Post
• https://t.me/cvenotify/70266 · Telegram Post
• https://t.me/cvenotify/71629 · Telegram Post
• https://t.me/cvenotify/71589 · Telegram Post