GHSA-m95h-p4gg-wfw3

ghsaUSosv

Allegro AI ClearML path traversal vulnerability

view advisory published 2024-02-06Licence: CC-BY-4.0

A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary location on an end user’s system when interacted with.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-24591US	high8.8	0.80% (56th)	—	2024-02-06
A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write local or remote files…

references

External citations — patches, advisories, analysis.

https://github.com/allegroai/clearmlPACKAGE
https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chainWEB
https://nvd.nist.gov/vuln/detail/CVE-2024-24591ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan