GitHub Advisoryadvisory · PyPI

GHSA-gvqv-h7hh-6fcc Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance

MEDIUM Published 2024-02-06 Modified 2024-02-13 Official page ↗
Aliases
CVE-2024-24595
Ecosystem
PyPI
Packages
clearml
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-312, CWE-522
Reviewed
2024-02-09

Affected packages

• PyPI clearml: <= 1.14.2 (no fix yet)

Description

Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords.

Related

Alias · CVE (1)

  • CVE-2024-24595 Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server… vulnerability

Weakness · CWE (2)

  • CWE-312 Cleartext Storage of Sensitive Information weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References