Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily access, create, modify and delete files.
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
| Link | Tags |
|---|---|
| https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/ | third party advisory exploit |