CVE-2024-24590

Severity CVSS v4.0:
Pending analysis
Type:
CWE-502 Deserialization of Untrusted Dat
Publication date:
06/02/2024
Last modified:
15/02/2024

Description

Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with.<br />

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:clear:clearml:*:*:*:*:*:*:*:* 0.17.0 (including) 1.14.2 (including)