Home » Database

AVID-2026-R1634

Description

Cross-Site Request Forgery (CSRF) in polyaxon/polyaxon (CVE-2024-9365)

Details

A Cross-Site Request Forgery (CSRF) vulnerability in polyaxon/polyaxon v2.4.0 allows attackers to perform unauthorized actions in the context of the victim’s browser. This includes creating projects, model versions, and artifact versions, or changing settings. The impact of this vulnerability includes potential data loss and service disruption.

Reason for inclusion in AVID: CVE-2024-9365 describes a CSRF vulnerability in polyaxon, an ML orchestration platform used in AI workflows. This is a software vulnerability affecting a tool used in building/training/deploying AI systems, i.e., in the AI software stack. It concerns software supply chain components (library/framework/platform) rather than hardware/firmware, and impacts security, with potential unauthorized actions in the AI pipeline. The report provides CVE details, CVSS, etc.

References

Affected or Relevant Artifacts

  • Developer: polyaxon
  • Deployer: polyaxon
  • Artifact Details:
TypeName
Systempolyaxon/polyaxon

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.0
Vector StringCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Base Score6.5
Base Severity🟠 Medium
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity Impact🔴 High
Availability ImpactNONE

CWE

IDDescription
CWE-352CWE-352 Cross-Site Request Forgery (CSRF)

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2025-03-20
  • Version: 0.3.3
  • AVID Entry