Lucene search

K
githubGitHub Advisory DatabaseGHSA-FMXJ-6H9G-6VW3
HistoryJul 19, 2023 - 3:30 a.m.

MLflow Path Traversal vulnerability

2023-07-1903:30:27
CWE-36
GitHub Advisory Database
github.com
11
github
repository
absolute path traversal

CVSS3

10

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

0.015

Percentile

87.1%

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.

Affected configurations

Vulners
Node
mlflowmlflowRange<2.5.0
VendorProductVersionCPE
mlflowmlflow*cpe:2.3:a:mlflow:mlflow:*:*:*:*:*:*:*:*

CVSS3

10

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

0.015

Percentile

87.1%