CVE-2025-1473 CSRF in mlflow/mlflow

A Cross-Site Request Forgery CSRF vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacker to create a new account, which may be used to perform unauthorized actions on behalf of the malicious user...

a2 (>=0.1.0, <=0.3.17), agentos (>=0.0.5, <=0.0.7) +212 more potentially affected by CVE-2025-1474 via mlflow (>=0.8.2, <=2.18.0)

mlflow PYPI version =0.8.2, =0.1.0, =0.0.5, =0.0.1, =1.0.0, =1.0.1, =0.1.2, =0.1.0, =1.0.18.2, =0.0.1, =1.0.41, =1.4.0, =0.1.3, =0.3.2 and more Source cves: CVE-2025-1474 Source advisory: MEND:CVE-2025-1474...

CVE-2025-1474 Weak Password Requirements in mlflow/mlflow

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user accou...

CVE-2025-1473 CSRF in mlflow/mlflow

A Cross-Site Request Forgery CSRF vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacker to create a new account, which may be used to perform unauthorized actions on behalf of the malicious user...

CVE-2025-1474

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user accou...

api-python-bet-project (>=0.1.9, <=0.1.22), argosml (>=0.0.1, <=0.1.3) +24 more potentially affected by CVE-2025-1473 via mlflow (>=2.17.0, <=2.20.2)

mlflow PYPI version =2.17.0, =0.1.9, =0.0.1, =1.0.6, =1.1.5, =1.6.0, =0.14.0, =0.14.0, =0.14.0, =0.1.1, =0.15.0, =1.4.4, =1.11.2 - mlflow-cors 0.1.1 - mlflow-dep-analyzer 0.7.0 and more Source cves: CVE-2025-1473 Source advisory: MEND:CVE-2025-1473...

CVE-2025-1473

In MLflow (mlflow/mlflow), a CSRF vulnerability affects versions 2.17.0 to 2.20.1 in the Signup feature, allowing an attacker to create a new account and potentially perform unauthorized actions on behalf of the attacker’s account. The CVE-2025-1473 entry documents the flaw and its impact as Cros...

CVE-2025-1473

A Cross-Site Request Forgery CSRF vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacker to create a new account, which may be used to perform unauthorized actions on behalf of the malicious user...

CVE-2025-1473 CSRF in mlflow/mlflow

A Cross-Site Request Forgery CSRF vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacker to create a new account, which may be used to perform unauthorized actions on behalf of the malicious user...

CVE-2024-8859 Path Traversal in mlflow/mlflow

A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the path part of the URL is checked, while...

CVE-2024-8859

Mlflow/mlflow 2.15.1 contains a path traversal/local file read vulnerability when using the dbfs service: the URL is interpolated into the file protocol with only the path portion validated, enabling reading arbitrary server files when dbfs is mounted locally. Public sources (Nuclei template, OSV...

a2 (>=0.1.0, <=0.3.17), agentos (>=0.0.5, <=0.0.7) +203 more potentially affected by CVE-2024-8859 via mlflow (>=0.8.2, <=2.16.2)

mlflow PYPI version =0.8.2, =0.1.0, =0.0.5, =1.0.0, =1.0.1, =0.1.2, =0.1.0, =1.0.18.2, =0.0.1, =1.0.41, =1.4.0, =0.1.3, =3.0.0, =3.3.0 - birm-nm-foo 1.5.0 and more Source cves: CVE-2024-8859 Source advisory: MEND:CVE-2024-8859...

CVE-2024-8859 Path Traversal in mlflow/mlflow

A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the path part of the URL is checked, while...

CVE-2024-8859 Path Traversal in mlflow/mlflow

A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the path part of the URL is checked, while...

CVE-2024-8859

A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the path part of the URL is checked, while...

CVE-2024-6838

In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a limit on the experiment name. This can cause the MLflow UI panel to become unresponsive, leading to a potential denial of...

CVE-2024-6838 Uncontrolled Resource Consumption in mlflow/mlflow

In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a limit on the experiment name. This can cause the MLflow UI panel to become unresponsive, leading to a potential denial of...

CVE-2024-6838

CVE-2024-6838 affects mlflow/mlflow v2.13.2, allowing creation or renaming of an experiment with an unbounded number of integers in the name and no limit on the artifact_location, leading to potential denial of service due to UI unresponsiveness (uncontrolled resource consumption). The vulnerabil...

CVE-2024-6838 Uncontrolled Resource Consumption in mlflow/mlflow

In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a limit on the experiment name. This can cause the MLflow UI panel to become unresponsive, leading to a potential denial of...

CVE-2024-6838 Uncontrolled Resource Consumption in mlflow/mlflow

In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a limit on the experiment name. This can cause the MLflow UI panel to become unresponsive, leading to a potential denial of...