CVE-2023-1177

🗓️ 24 Mar 2023 00:00:00Reported by @huntrdevType

cve🔗 web.nvd.nist.gov👁 157 Views🌐 WEB

CVE-2023-1177 Path Traversal in GitHub repository mlflow/mlflo

Reporter	Title	Published	Views	Family All 22
Huntr	LFI/RFI in MLflow	3 Mar 202317:15	–	huntr
Huntr	Local File Read Bypass in mlflow/mlflow	27 Mar 202311:20	–	huntr
GithubExploit	Exploit for Path Traversal in Lfprojects Mlflow	12 Apr 202510:33	–	githubexploit
Circl	CVE-2023-1177	24 Mar 202317:50	–	circl
CNNVD	Mlflow 路径遍历漏洞	24 Mar 202300:00	–	cnnvd
Cvelist	CVE-2023-1177 Path Traversal: '\..\filename' in mlflow/mlflow	24 Mar 202300:00	–	cvelist
Github Security Blog	Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs	1 May 202313:43	–	github
Github Security Blog	mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIs	24 Mar 202322:01	–	github
Nuclei	Mlflow <2.2.1 - Local File Inclusion	1 Jun 202605:38	–	nuclei
NVD	CVE-2023-1177	24 Mar 202315:15	–	nvd

NVD

Node

lfprojects mlflowRange<2.2.1

[
  {
    "defaultStatus": "unaffected",
    "product": "mlflow/mlflow",
    "vendor": "mlflow",
    "versions": [
      {
        "lessThan": "2.2.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.dev/bounties/1fe8f21a-c438-4cba-9add-e8a5dab94e28
github	www.github.com/mlflow/mlflow/pull/7891/commits/7162a50c654792c21f3e4a160eb1a0e6a34f6e6e

Parameter	Position	Path	Description	CWE
path	query param	/model-versions/get-artifact	Local File Inclusion via path parameter in get-artifact endpoint (path traversal).	CWE-22CWE-29

21 Nov 2024 07:38Current

9.4High risk

Vulners AI Score9.4

CVSS 3.19.3 - 9.8

EPSS0.93314

SSVC

cve 2023 1177 path traversal github mlflow nvd