Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs

🗓️ 01 May 2023 13:43:58Reported by GitHub Advisory DatabaseType

Remote file access vulnerability in MLflow server and MLflow ui CLIs. Users of MLflow Open Source Project hosting MLflow Model Registry using older than MLflow 2.3.1 may be vulnerable to a remote file access exploit. Integrations not using MLflow server or ui are unaffected. Patches available in MLflow 2.3.1, released on April 27th, 2023

Reporter	Title	Published	Views	Family All 24
Huntr	LFI/RFI in MLflow	3 Mar 202317:15	–	huntr
Huntr	Local File Read Bypass in mlflow/mlflow	27 Mar 202311:20	–	huntr
GithubExploit	Exploit for Path Traversal in Lfprojects Mlflow	12 Apr 202510:33	–	githubexploit
BDU FSTEC	The vulnerability of the ML lifecycle management platform, related to an incorrect restriction on the path name for the restricted access catalog, allows a perpetrator to gain unauthorized access to protected information, execute arbitrary code, or obtain full control over the system.	30 Mar 202300:00	–	bdu_fstec
Circl	CVE-2023-1177	24 Mar 202317:50	–	circl
CNNVD	Mlflow 路径遍历漏洞	24 Mar 202300:00	–	cnnvd
CVE	CVE-2023-1177	24 Mar 202300:00	–	cve
Cvelist	CVE-2023-1177 Path Traversal: '\..\filename' in mlflow/mlflow	24 Mar 202300:00	–	cvelist
Github Security Blog	mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIs	24 Mar 202322:01	–	github
Nuclei	Mlflow <2.2.1 - Local File Inclusion	26 Jun 202618:13	–	nuclei