Allegro.AI vulnerabilities
We track 5 vulnerabilities in Allegro.AI products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on February 6, 2024.
Latest Allegro.AI vulnerabilities
- 8.8 High severity
ClearML: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability in all versions up to 1.14.1 of the api server component of Allegro AI’s ClearML platform allows a remote attacker to impersonate a user by sending API requests via maliciously crafted html. Exploitation of the
- 9.8 Critical severity
ClearML: Improper Authentication
Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily access, create, modify and delete files.
- 8.8 High severity
ClearML: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary location on an end user’s system when interacted with.
- 8.8 High severity
ClearML: Deserialization of Untrusted Data
Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with.
- 7.1 High severity
ClearML: Insufficiently Protected Credentials
Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords.