CVE-2024-9365

A Cross-Site Request Forgery (CSRF) vulnerability in polyaxon/polyaxon v2.4.0 allows attackers to perform unauthorized actions in the context of the victim's browser. This includes creating projects, model versions, and artifact versions, or changing settings. The impact of this vulnerability includes potential data loss and service disruption.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://huntr.com/bounties/cdfa012b-a694-4beb-9a9a-12a9dde07ef9

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de Cross-Site Request Forgery (CSRF) en polyaxon/polyaxon v2.4.0 permite a los atacantes realizar acciones no autorizadas en el navegador de la víctima. Esto incluye la creación de proyectos, versiones de modelos y de artefactos, o la modificación de la configuración. El impacto de esta vulnerabilidad incluye la posible pérdida de datos e interrupción del servicio.

20 Mar 2025, 10:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-03-20 10:15

Updated : 2026-06-17 08:24

NVD link : CVE-2024-9365

Mitre link : CVE-2024-9365

CVE.ORG link : CVE-2024-9365

JSON object : View

Products Affected

No product.

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2024-9365", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-9365", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-20T17:48:08.243388Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@huntr.dev", "affectedData": [{"vendor": "polyaxon", "product": "polyaxon/polyaxon", "versions": [{"status": "affected", "version": "unspecified", "versionType": "custom", "lessThanOrEqual": "latest"}]}]}], "published": "2025-03-20T10:15:48.467", "references": [{"url": "https://huntr.com/bounties/cdfa012b-a694-4beb-9a9a-12a9dde07ef9", "source": "security@huntr.dev"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "A Cross-Site Request Forgery (CSRF) vulnerability in polyaxon/polyaxon v2.4.0 allows attackers to perform unauthorized actions in the context of the victim's browser. This includes creating projects, model versions, and artifact versions, or changing settings. The impact of this vulnerability includes potential data loss and service disruption."}, {"lang": "es", "value": "Una vulnerabilidad de Cross-Site Request Forgery (CSRF) en polyaxon/polyaxon v2.4.0 permite a los atacantes realizar acciones no autorizadas en el navegador de la v\u00edctima. Esto incluye la creaci\u00f3n de proyectos, versiones de modelos y de artefactos, o la modificaci\u00f3n de la configuraci\u00f3n. El impacto de esta vulnerabilidad incluye la posible p\u00e9rdida de datos e interrupci\u00f3n del servicio."}], "lastModified": "2026-06-17T08:24:25.827", "sourceIdentifier": "security@huntr.dev"}