CVE-2024-24593

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-24593
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-24593.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-24593
Published
2024-02-06T14:41:44Z
Modified
2026-10-21T02:51:06Z
Severity
  • 9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A cross-site request forgery (CSRF) vulnerability in all versions up to 1.14.1 of the api server component of Allegro AI’s ClearML platform allows a remote attacker to impersonate a user by sending API requests via maliciously crafted html. Exploitation of the vulnerability allows an attacker to compromise confidential workspaces and files, leak sensitive information, and target instances of the ClearML platform within closed off networks.

Database specific 
{
    "cna_assigner":  "HiddenLayer",
    "cwe_ids":  [
        "CWE-352"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24593.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "1.14.2"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/clearml/clearml-server

Affected ranges

Type
GIT
Repo
https://github.com/clearml/clearml-server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
6a1fc04d1e8b112fb334c8743d29731103b9fc4a
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "1.14.1"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

0.*
0.10.0
0.10.1
0.11.0
0.12.0
0.12.1
0.13.0
0.14.0
0.14.1
0.14.2
0.15.0
0.15.1
0.16.0
0.16.1
0.17.0
0.9.0
1.*
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
v1.*
v1.10
v1.10.1
v1.11.0
v1.12.0
v1.12.1
v1.13.0
v1.13.1
v1.14.0
v1.14.1
v1.3.0
v1.3.1
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0
v1.9.1
v1.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-24593.json"