CVE-2024-24594

An attacker with minimal privilege level (authenticated user) can deliver a malicious payload that is subsequently rendered without proper sanitization in the Debug Samples tab of the ClearML web interface. When another user views this tab, the browser executes the embedded JavaScript code in the context of the application. The vulnerability works remotely over the network without requiring attacker interaction beyond initial payload preparation.

An attacker can hijack a user session, steal sensitive data (tokens, credentials, ML model information), and in a changed context (Scope:Changed) potentially affect resources beyond the victim's direct session. High impact ratings on confidentiality, integrity, and availability indicate the possibility of complete account takeover of the attacked user.

Apply patches available from the vendor according to the references. Additional temporary measures: restrict access to the ClearML web interface exclusively to trusted users and internal networks, monitor activity in the Debug Samples tab for anomalies.

All versions of the web server component of the Allegro AI ClearML platform (as described: 'all versions of the web server component').