CVE-2023-6831: Path Traversal: '\..\filename'

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2...

Mlflow Security Vulnerabilities

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow versions prior to 2.9.2 that stems from the presence of a path traversal vulnerability...

PT-2023-32782 · Mlflow · Mlflow

Name of the Vulnerable Software and Affected Versions: mlflow/mlflow versions prior to 2.9.2 Description: The issue is related to a Path Traversal vulnerability, where the sequence '..filename' can be used to access files outside the intended directory. This vulnerability is present in the...

Arbitrary Code Execution

mlflow is vulnerable to Arbitrary Code Execution. The vulnerability exists due to improper neutralization of special elements used in a template engine which allows an attacker to inject and execute arbitrary code...

GHSA-V945-R3RC-6FJM Path traversal in MLflow

Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2...

Path traversal in MLflow

Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2...

dagster-mlflow (>=0.18.0, <=0.18.3), dbx (0.5.0) +13 more potentially affected by CVE-2023-6753 via mlflow (1.26.1)

mlflow PYPI version 1.26.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.18.0, =0.2.5, =0.0.1, =0.3.3, =0.2.0.dev3, =0.2.0.dev2, =0.40.2.dev25, =0.40.2.dev18, =0.39.1rc2, =3.2.7, =0.0.1, =0.1.2, =0.2.1...

dagster-mlflow (>=0.14.18rc5, <=0.17.21), sparkpipelineframework (1.0.18) potentially affected by CVE-2023-6753 via mlflow (1.26.0)

mlflow PYPI version 1.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.14.18rc5, =0.17.21 - sparkpipelineframework 1.0.18 Source cves: CVE-2023-6753 Source advisory: OSV:GHSA-V945-R3RC-6FJM...

openstef (>=3.2.0a0, <=3.2.6) potentially affected by CVE-2023-6753 via mlflow (1.25.1)

mlflow PYPI version 1.25.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - openstef =3.2.0a0, =3.2.6 Source cves: CVE-2023-6753 Source advisory: OSV:GHSA-V945-R3RC-6FJM...

autorad (>=0.2.2, <=0.2.5), katonic (>=1.3.0, <=1.6.0) potentially affected by CVE-2023-6753 via mlflow (1.23.1)

mlflow PYPI version 1.23.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad =0.2.2, =1.3.0, =1.6.0 Source cves: CVE-2023-6753 Source advisory: OSV:GHSA-V945-R3RC-6FJM...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2023-6753 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2023-6753 Source advisory: OSV:GHSA-V945-R3RC-6FJM...

mlfields (0.0.0), poms (0.0.0) potentially affected by CVE-2023-6753 via mlflow (1.20.1)

mlflow PYPI version 1.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - mlfields 0.0.0 - poms 0.0.0 Source cves: CVE-2023-6753 Source advisory: OSV:GHSA-V945-R3RC-6FJM...

iqradre (>=0.1.5, <=0.2.1) potentially affected by CVE-2023-6753 via mlflow (1.20.0)

mlflow PYPI version 1.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - iqradre =0.1.5, =0.2.1 Source cves: CVE-2023-6753 Source advisory: OSV:GHSA-V945-R3RC-6FJM...

mlflow-dl (>=0.2.0, <=0.2.2), mlsriracha (0.0.2) +1 more potentially affected by CVE-2023-6753 via mlflow (1.19.0)

mlflow PYPI version 1.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - mlflow-dl =0.2.0, =0.1.0, =2.0.8 Source cves: CVE-2023-6753 Source advisory: OSV:GHSA-V945-R3RC-6FJM...

deepinterpolation (>=0.1.3, <=0.1.4), scanflow (>=0.1.0, <=0.1.1) +1 more potentially affected by CVE-2023-6753 via mlflow (1.14.1)

mlflow PYPI version 1.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - deepinterpolation =0.1.3, =0.1.0, =0.0.1, =0.7.1 Source cves: CVE-2023-6753 Source advisory: OSV:GHSA-V945-R3RC-6FJM...

biome-text (>=3.0.0, <=3.2.1), farm (>=0.6.2, <=0.8.0) +5 more potentially affected by CVE-2023-6753 via mlflow (1.13.1)

mlflow PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - biome-text =3.0.0, =0.6.2, =0.7.0, =0.0.1, =1.1.0, =1.0.0, =0.4.5.dev2, =0.6.5 Source cves: CVE-2023-6753 Source advisory: OSV:GHSA-V945-R3RC-6FJM...

backwardcompatibilityml (>=1.4.0, <=1.4.2), layer-client (>=0.3.7b1, <=0.3.9) potentially affected by CVE-2023-6753 via mlflow (1.12.1)

mlflow PYPI version 1.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - backwardcompatibilityml =1.4.0, =0.3.7b1, =0.3.9 Source cves: CVE-2023-6753 Source advisory: OSV:GHSA-V945-R3RC-6FJM...

layer-client (0.3.6), odahu-flow-mlflow-runner (1.4.0rc1) potentially affected by CVE-2023-6753 via mlflow (1.12.0)

mlflow PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.6 - odahu-flow-mlflow-runner 1.4.0rc1 Source cves: CVE-2023-6753 Source advisory: OSV:GHSA-V945-R3RC-6FJM...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2023-6753 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2023-6753 Source advisory: OSV:GHSA-V945-R3RC-6FJM...

agentos (>=0.0.5, <=0.0.7) potentially affected by CVE-2023-6753 via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: CVE-2023-6753 Source advisory: OSV:GHSA-V945-R3RC-6FJM...