CVE-2024-24593 - CVE House
Back to Database
Status published Critical CVE-2024-24593

A cross-site request forgery (CSRF) vulnerability in all versions up...

Vulnerability Description

A cross-site request forgery (CSRF) vulnerability in all versions up to 1.14.1 of the api server component of Allegro AI’s ClearML platform allows a remote attacker to impersonate a user by sending API requests via maliciously crafted html. Exploitation of the vulnerability allows an attacker to compromise confidential workspaces and files, leak sensitive information, and target instances of the ClearML platform within closed off networks.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-24593

Credits & Attribution

No credits recorded in the NVD database.

References

More from Allegro.AI

View All →
CVE-2024-24595
Allegro AI’s open-source version of ClearML stores passwords in plaintext...
Medium 6
CVE-2024-24594
A cross-site scripting (XSS) vulnerability in all versions of the...
Critical 9.9
CVE-2024-24592
Lack of authentication in all versions of the fileserver component...
Critical 9.8
CVE-2024-24591
A path traversal vulnerability in versions 1.4.0 to 1.14.1 of...
High 8
CVE-2024-24590
Deserialization of untrusted data can occur in versions 0.17.0 to...
High 8

Affected Vendor

Affected Software

ClearML
Vulnerable Versions:
0

Timeline

Official Publish: February 6th, 2024
Last Modified: June 17th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-352

MITRE ATT&CK TTPs

T1566.002 Spearphishing Link
Initial Access
T1204.001 Malicious Link
Execution
T1098 Account Manipulation
Persistence
T1565.001 Stored Data Manipulation
Impact