Cross-Site Request Forgery (CSRF) Vulnerability in Allegro AI's ClearML Platform Allows Remote Attacker to Impersonate Users

CVE-2024-24593

What is CVE-2024-24593?

A cross-site request forgery (CSRF) vulnerability exists in all versions up to 1.14.1 of the API server component of Allegro AI’s ClearML platform. This vulnerability enables remote attackers to impersonate legitimate users by sending crafted API requests through malicious HTML. The exploitation of this vulnerability poses risks such as unauthorized access to confidential workspaces, leakage of sensitive information, and potential targeting of ClearML platform instances, even within isolated networks. Organizations utilizing ClearML should prioritize patching this vulnerability to safeguard their data and maintain the integrity of their operations.

References