GHSA-gvqv-h7hh-6fcc

Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-24595

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	clearml	<= 1.14.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-24595 advisory
https://github.com/allegroai/clearml package
https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain web