Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: mlflow/mlflow 2.9.2 Clear all filters
TI-2023-06378 CVE-2023-6977 · GHSA-qg8p-32gr-gh6x

Path Traversal: '\..\filename'

Priority MEDIUM 40

This vulnerability enables malicious users to read sensitive files on the server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03924 Published 2023-12-20 Fixed in 2.9.2 CWE-29
TI-2023-06377 CVE-2023-6976 · GHSA-wv8q-4f85-2p8p

Unrestricted Upload of File with Dangerous Type

Priority MEDIUM 40

This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01016 Published 2023-12-20 Fixed in 2.9.2 CWE-434
TI-2023-06376 CVE-2023-6975 · GHSA-hh8p-p8mp-gqhm

Path Traversal: '\..\filename'

Priority MEDIUM 46

A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0203 Published 2023-12-20 Fixed in 2.9.2 CWE-29
TI-2023-06375 CVE-2023-6974 · GHSA-59v3-898r-qwhj

Server-side request forgery (SSRF) in mlflow/mlflow

Priority MEDIUM 45

A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abuse to get a remote code execution on the victim machine.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01519 Published 2023-12-20 Fixed in 2.9.2 CWE-918