PT-2025-12279 · Polyaxon · Polyaxon

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-9365

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions polyaxon/polyaxon version 2.4.0

Description A Cross-Site Request Forgery (CSRF) issue allows attackers to perform unauthorized actions in the context of the victim's browser, including creating projects, model versions, and artifact versions, or changing settings. The impact of this issue includes potential data loss and service disruption.

Recommendations For polyaxon/polyaxon version 2.4.0, consider disabling the affected functionality until a patch is available. Restrict access to sensitive operations, such as project creation and configuration changes, to minimize the risk of exploitation. Avoid using the vulnerable version for critical operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-9365

Affected Products

Polyaxon

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-9365 · Security Note
• https://huntr.com/bounties/cdfa012b-a694-4beb-9a9a-12a9dde07ef9 · Note
• https://twitter.com/CVEnew/status/1902671077936971823 · Twitter Post