CVE-2024-39272 - Vulnerability Details - OpenCVE

ReportizFlow

A cross-site scripting (xss) vulnerability exists in the dataset upload functionality of ClearML Enterprise Server 3.22.5-1533. A specially crafted HTTP request can lead to an arbitrary html code. An attacker can send a series of HTTP requests to trigger this vulnerability.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Clear	Clearml Enterprise Server

Configuration 1 [-]

cpe:2.3:a:clear:clearml_enterprise_server:3.22.5-1533:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://talosintelligence.com/vulnerability_reports/TALOS-2024-2110
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2110

History

Fri, 05 Sep 2025 17:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Clear Clear clearml Enterprise Server
CPEs		cpe:2.3:a:clear:clearml_enterprise_server:3.22.5-1533:::::::*
Vendors & Products		Clear Clear clearml Enterprise Server

Wed, 12 Feb 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 06 Feb 2025 19:45:00 +0000

Type	Values Removed	Values Added
References		https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2110

Thu, 06 Feb 2025 17:00:00 +0000

Type	Values Removed	Values Added
Description		A cross-site scripting (xss) vulnerability exists in the dataset upload functionality of ClearML Enterprise Server 3.22.5-1533. A specially crafted HTTP request can lead to an arbitrary html code. An attacker can send a series of HTTP requests to trigger this vulnerability.
Weaknesses		CWE-79
References		https://talosintelligence.com/vulnerability_reports/TALOS-2024-2110
Metrics		cvssV3_1 `{'score': 9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: talos

Published: 2025-02-06T16:47:29.134Z

Updated: 2025-02-12T19:51:09.249Z

Reserved: 2024-11-13T21:55:27.557Z

Link: CVE-2024-39272

Vulnrichment

Updated: 2025-02-12T19:41:18.499Z

NVD

Status : Analyzed

Published: 2025-02-06T17:15:18.647

Modified: 2025-09-05T17:32:43.667

Link: CVE-2024-39272

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-39272", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "state": "PUBLISHED", "assignerShortName": "talos", "dateReserved": "2024-11-13T21:55:27.557Z", "datePublished": "2025-02-06T16:47:29.134Z", "dateUpdated": "2025-02-12T19:51:09.249Z"}, "containers": {"cna": {"affected": [{"vendor": "ClearML", "product": "ClearML", "versions": [{"version": "Enterprise Server 3.22.5-1533", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A cross-site scripting (xss) vulnerability exists in the dataset upload functionality of ClearML Enterprise Server 3.22.5-1533. A specially crafted HTTP request can lead to an arbitrary html code. An attacker can send a series of HTTP requests to trigger this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE", "cweId": "CWE-79"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL"}}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2025-02-06T16:47:29.134Z"}, "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2110", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2110"}], "credits": [{"lang": "en", "value": "Edwin Molenaar of Cisco Meraki Offensive Security Team"}]}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2110"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-02-06T19:02:34.698Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-39272", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-06T17:09:43.732521Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-12T19:51:09.249Z"}}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:clear:clearml_enterprise_server:3.22.5-1533:*:*:*:*:*:*:*", "matchCriteriaId": "BAF76DBA-9034-4A07-B0EE-00A04B71EC06", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A cross-site scripting (xss) vulnerability exists in the dataset upload functionality of ClearML Enterprise Server 3.22.5-1533. A specially crafted HTTP request can lead to an arbitrary html code. An attacker can send a series of HTTP requests to trigger this vulnerability."}, {"lang": "es", "value": "Existe una vulnerabilidad de cross-site scripting (XSS) en la funci\u00f3n de carga de conjuntos de datos de ClearML Enterprise Server 3.22.5-1533. Una solicitud HTTP especialmente manipulada puede generar un c\u00f3digo HTML arbitrario. Un atacante puede enviar una serie de solicitudes HTTP para activar esta vulnerabilidad."}], "id": "CVE-2024-39272", "lastModified": "2025-09-05T17:32:43.667", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "[email protected]", "type": "Primary"}]}, "published": "2025-02-06T17:15:18.647", "references": [{"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2110"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2110"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "[email protected]", "type": "Secondary"}]}