CVE-2024-24590
HIGH 8.8EPSS 2.5%
Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with.
- CVSS v3.1
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS v3.1
- 8.0 HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - CVSS v3.1
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS
- 2.47% chance of exploitation in the next 30 days, 83th percentile
- Published
- 2024-02-06
- Updated
- 2025-06-17
Proof-of-concept exploits (8)
- OxyDeV2/ClearML-CVE-2024-245906★ · 2024-06-13
- diegogarciayala/CVE-2024-24590-ClearML-RCE-CMD-POC9★ · 2024-06-15
- j3r1ch0123/CVE-2024-245900★ · 2024-10-07
- junnythemarksman/CVE-2024-245901★ · 2024-06-21
- sviim/ClearML-CVE-2024-245904★ · 2024-07-21
- sviim/ClearML-CVE-2024-24590-RCE4★ · 2024-07-21
- xffsec/CVE-2024-24590-ClearML-RCE-Exploit0★ · 2024-06-13
- rippsec/CVE-2024-24590-ClearML-RCE-Exploit