CVE-2024-24591

2024-02-0615:15:09

CWE-22

6f8de1f0-f67e-45a6-b68f-98777fdb759c

web.nvd.nist.gov

allegro ai

clearml

path traversal

vulnerability

file writes

cve-2024-24591

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.4%

JSON

A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary location on an end user’s system when interacted with.

Affected configurations

NVD

Node

clearclearmlRange1.4.0–1.14.1

CPENameOperatorVersion
clear:clearmlclear clearmlle1.14.1

CPE	Name	Operator	Version
clear:clearml	clear clearml	le	1.14.1

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "packageName": "clearml",
    "product": "ClearML",
    "repo": "https://github.com/allegroai/clearml",
    "vendor": "Allegro.AI",
    "versions": [
      {
        "lessThan": "1.14.2",
        "status": "affected",
        "version": "1.4.0",
        "versionType": "custom"
      }
    ]
  }
]