CVE-2024-24593

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A cross-site request forgery (CSRF) vulnerability in all versions up to 1.14.1 of the api server component of Allegro AI’s ClearML platform allows a remote attacker to impersonate a user by sending API requests via maliciously crafted html. Exploitation of the vulnerability allows an attacker to compromise confidential workspaces and files, leak sensitive information, and target instances of the ClearML platform within closed off networks.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Allegro.AI	ClearML	< 1.14.2

References

https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/Exploit, Technical Description, Third Party Advisory
https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/Exploit, Technical Description, Third Party Advisory

Timeline

Published: Feb 6, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-245945.4A cross-site scripting (XSS) vulnerability in all versions of the web server component of Allegro AI’s ClearML platform allows a remote atta CVE-2024-245957.1Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server lea CVE-2024-24605.4The GamiPress – Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gamipress_button' shortcode in al CVE-2024-24616.9If exploited an attacker could traverse the file system to access files or directories that would otherwise be inaccessible CVE-2024-24626.8Allow attackers to intercept or falsify data exchanges between the client and the server CVE-2024-246219.8Softaculous Webuzo contains an authentication bypass vulnerability through the password reset functionality. Remote, anonymous attackers can CVE-2024-246228.8Softaculous Webuzo contains a command injection in the password reset functionality. A remote, authenticated attacker can exploit this vulne CVE-2024-246238.8Softaculous Webuzo contains a command injection vulnerability in the FTP management functionality. A remote, authenticated attacker can expl CVE-2024-24638.0Weak password recovery mechanism in CDeX application allows to retrieve password reset token.This issue affects CDeX application versions th CVE-2024-24646.3This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not,CVE-2024-24657.1Open redirection vulnerability in CDeX application allows to redirect users to arbitrary websites via a specially crafted URL.This issue aff CVE-2024-24666.5libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcu