CVE-2024-3848 Path Traversal Bypass in mlflow/mlflow

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '' character can be used to insert a path into the fragment, effectively...

auf (>=1.0.0, <=2.0.1), auto-mlflow (1.0.0) +21 more potentially affected by CVE-2024-3848 via mlflow (>=2.9.2, <=2.11.3)

mlflow PYPI version =2.9.2, =1.0.0, =0.0.40.post1, =1.2.0, =0.9.21, =0.0.10, =0.1.0, =0.1.1, =0.1.2, =1.2.7, =0.1.0, =1.0.0, =2.9.2, =1.8.2, =1.8.5 - mlops-utils 0.0.1 and more Source cves: CVE-2024-3848 Source advisory: MEND:CVE-2024-3848...

CVE-2024-3848

CVE-2024-3848 affects mlflow/mlflow up to version 2.11.0. The path traversal stems from improper handling of the fragment component in artifact URLs, where a ‘#’ can insert a path into the URL fragment and bypass validation, allowing an attacker to read arbitrary files by mapping the URL to a fil...

CVE-2024-3848

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '' character can be used to insert a path into the fragment, effectively...

CVE-2024-3848 Path Traversal Bypass in mlflow/mlflow

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '' character can be used to insert a path into the fragment, effectively...

CVE-2024-3848 Path Traversal Bypass in mlflow/mlflow

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '' character can be used to insert a path into the fragment, effectively...

PT-2024-30080 · Mlflow · Mlflow

Name of the Vulnerable Software and Affected Versions: mlflow/mlflow versions before 2.10.1 Description: A broken access control issue exists, allowing low privilege users with only EDIT permissions on an experiment to delete any artifacts. This occurs due to the lack of proper validation for...

CVE-2024-4263: Improper Access Control

A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low privilege users with only EDIT permissions on an experiment can delete any artifacts. This issue arises due to the lack of proper validation for DELETE requests by users with EDIT permissions, allowing...

PT-2024-28025

Name of the Vulnerable Software and Affected Versions mlflow/mlflow version 2.11.0 Description A path traversal issue exists due to insufficient validation of the fragment portion of artifact URLs. An attacker can exploit this by inserting a '' character into the URL fragment, allowing them to...

Mlflow: Access Control Vulnerability

Mlflow is an open source platform for machine learning lifecycles. An access control error vulnerability exists in Mlflow versions prior to 2.10.1 that stems from incorrect access control...

CVE-2024-3848: Path Traversal: '\..\filename'

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '' character can be used to insert a path into the fragment, effectively...

Mlflow security vulnerabilities

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow version 2.11.0, which stems from insufficient validation of the fragment portion of a URL, leading to the reading of arbitrary files via path traversal...

Mlflow Path Traversal Vulnerability (CNVD-2024-35608)

Mlflow is an open source platform for the machine learning lifecycle. Mlflow version 2.9.2 suffers from a path traversal vulnerability that stems from insufficient validation of user-supplied input. An attacker exploiting this vulnerability could access arbitrary files on the server...

Mlflow Path Traversal Vulnerability

Mlflow is an open source platform for the machine learning lifecycle. Mlflow suffers from a path traversal vulnerability that stems from improper handling of URL parameters. An attacker can use this vulnerability to gain access to a file or directory...

Path Traversal

mlflow/mlflow is vulnerable to a Path Traversal. The vulnerability is due to improper validation of the source parameter within handlers.py, allowing attackers to craft a parameter that bypasses checks, leading to arbitrary file read access on the server...

Path Traversal

mlflow is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of user-supplied input in the server's handlers, allowing attackers to access arbitrary files on the server by crafting HTTP POST requests with specially crafted parameters...

Local File Inclusion (LFI)

mlflow is vulnerable to Local File Inclusion LFI. The vulnerability is due to improper parsing of URIs within the function islocaluri in uri.py,, which allows an attackers to read arbitrary files on the system...

Path Traversal

MLflow is vulnerable to a path traversal attack. The vulnerability is due to improper handling of the artifactlocation parameter when creating an experiment, allowing attackers to exploit the fragment component of the URI to read arbitrary files on the server in the context of the server's proces...

Path Traversal

mlflow is vulnerable to a path traversal vulnerability. The vulnerability is due to an extra unquote operation in the deleteartifacts function of localartifactrepo.py, which fails to properly sanitize user-supplied paths. Attackers can exploit the double decoding process in the...

azureml-contrib-run (>=1.0.18.2, <=1.0.21.1) potentially affected by CVE-2024-3573 via mlflow (0.8.2)

mlflow PYPI version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.18.2, =1.0.21.1 Source cves: CVE-2024-3573 Source advisory: OSV:GHSA-HQ88-WG7Q-GP4G...