CVE-2024-4263

2024-05-1609:15:16

CWE-284

[email protected]

web.nvd.nist.gov

broken access control

vulnerability

mlflow

low privilege users

delete requests

unauthorized deletions

artifact handling

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

6.5 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low privilege users with only EDIT permissions on an experiment can delete any artifacts. This issue arises due to the lack of proper validation for DELETE requests by users with EDIT permissions, allowing them to perform unauthorized deletions of artifacts. The vulnerability specifically affects the handling of artifact deletions within the application, as demonstrated by the ability of a low privilege user to delete a directory inside an artifact using a DELETE request, despite the official documentation stating that users with EDIT permission can only read and update artifacts, not delete them.

CNA Affected

[
  {
    "vendor": "mlflow",
    "product": "mlflow/mlflow",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "2.10.1",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]