CVE-2024-24590
Severity CVSS v4.0:
Pending analysis
Type:
CWE-502
Deserialization of Untrusted Dat
Publication date:
06/02/2024
Last modified:
15/02/2024
Description
Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with.<br />
Impact
Base Score 3.x
8.80
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:clear:clearml:*:*:*:*:*:*:*:* | 0.17.0 (including) | 1.14.2 (including) |
To consult the complete list of CPE names with products and versions, see this page



