CVE-2024-37054-MLflow-reverse-shell

Strumenti e File...

CVE-2024-37054-MLflow-RCE

root@kitploit: | / || | | || | / \ \ / / | |/| || | | | | | | | | |\ \ /\ / / | | | || | | | | || || | \ V V / || |||||| ||/ // | \ / || | | \ / | | | || | | | | | |/ \ | | | | | | | | /| || | || \ ||| || / | CVE-2024-37054: PoC per Esecuzione di Codice Remoto in MLflow...

Exploit for Deserialization of Untrusted Data in Lfprojects Mlflow

CVE-2024-37054 — MLflow pyfunc Deserialization RCE Severity...

CVE-2024-37054

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37054 vulnerabilities

Vulnerabilities for packages: mlflow...

CVE-2024-37054

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37054

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37054

CVE-2024-37054 affects MLflow and stems from a deserialization issue in mlflow.pyfunc.load_model that processes PyFunc models, allowing a maliciously crafted model to trigger arbitrary code execution when loaded or interacted with. Public details (NVD entry) indicate versions 0.9.0 and newer are ...