CVE-2024-24592

Katalog CVE

CVSS 9.8 · Critical EPSS 0,98%

Kerentanan Direct Request ('Forced Browsing') pada clearml. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily access, create, modify and delete files.

Rincian

Terbit di NVD

6 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-425: Direct Request ('Forced Browsing')
CWE-287: Improper Authentication

EPSS (30 hari)

0,98% peluang dieksploitasi; lebih tinggi dari 61,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/ exploit · advisory pihak ketiga