high8.8
CVE-2024-24591
Allegro AI ClearML path traversal vulnerability
Impact
A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary location on an end user’s system when interacted with.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | clearml | >= 0.17.0, <= 1.14.1 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Clear | Clearml | from 1.4.0 through 1.14.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/
- https://github.com/advisories/GHSA-m95h-p4gg-wfw3
- https://nvd.nist.gov/vuln/detail/CVE-2024-24591
- https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain