CVE-2023-6568

2023-12-0705:15:09

CWE-79

@huntr_ai

web.nvd.nist.gov

cve-2023-6568

xss

cross-site scripting

github

mlflow

nvd

security issue

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

31.5%

JSON

A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the user without adequate sanitization or escaping, leading to arbitrary JavaScript execution in the context of the victim’s browser. The vulnerability is present in the mlflow/server/auth/init.py file, where the user-supplied Content-Type header is directly injected into a Python formatted string and returned to the user, facilitating the XSS attack.

Affected configurations

Nvd

Vulners

Node

lfprojectsmlflowRange≤2.9.0

VendorProductVersionCPE
lfprojectsmlflow*cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
lfprojects	mlflow	*	cpe:2.3:a:lfprojects:mlflow::::::::

CNA Affected

[
  {
    "vendor": "mlflow",
    "product": "mlflow/mlflow",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "2.9.0",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]