CVE-2023-43472

An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API...

CVE-2023-43472

An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API...

Design/Logic Flaw

An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API...

CVE-2023-43472

An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API...

a2 (>=0.1.0, <=0.3.17), agentos (>=0.0.5, <=0.0.7) +170 more potentially affected by CVE-2023-43472 via mlflow (>=0.8.2, <=2.8.1)

mlflow PYPI version =0.8.2, =0.1.0, =0.0.5, =1.0.1, =0.1.2, =0.1.0, =1.0.18.2, =0.0.1, =1.0.41, =1.4.0, =3.0.0, =0.1.2, =0.3.5, =0.8.0, =1.0.0 - cortic 0.1.0 and more Source cves: CVE-2023-43472 Source advisory: MEND:CVE-2023-43472...

MLFlow Security Vulnerability

Mlflow is an open source platform for the machine learning lifecycle. A security vulnerability exists in MLFlow version 2.8.1 and prior versions. A remote attacker exploited the vulnerability to obtain sensitive information via a specially crafted REST API request...

CVE-2023-43472

An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API...

CVE-2023-43472

MLFlow before 2.8.1 is affected by CVE-2023-43472. A remote attacker can disclose sensitive information via a crafted request to the MLFlow REST API. Impact described in sources: access to sensitive information stored in MLFlow. Root cause: issue exists in MLFlow 2.8.1 and earlier as stated in th...

CVE-2023-43472

An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API...

CVE-2023-43472: Undefined Security Weakness

An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API...

PT-2023-28836

Name of the Vulnerable Software and Affected Versions MLFlow versions 2.8.1 and before Description An issue in MLFlow allows a remote attacker to obtain sensitive information via a crafted request to the REST API. Approximately 4,120 devices are potentially affected, mainly distributed in the...

VulnCheck KEV: CVE-2023-1177

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1...

Path Traversal

mlflow is vulnerable to Path Traversal. The vulnerability is caused by a missing validation on Windows file paths starting with driver letter and colon e:g C:.. which result into relative paths when ultimately evaluated. This can lead to an attacker breaking out of the root mlflow directory e.g: ...

Authentication Bypass

mlflow is vulnerable to Authentication Bypass. The vulnerability is due to a bypass in both the mlflow server and mlflow UI around MLFlow's implementation of basic authentication. This flaw allows an unauthenticated malicious user to create a user/credential set using the 2.0 REST API...

autozeekwatch (>=0.1.0, <=0.1.3), azureml-evaluate-mlflow (>=0.0.4, <=0.0.36) +38 more potentially affected by CVE-2023-6014 via mlflow (>=2.0.0rc0, <=2.7.1)

mlflow PYPI version =2.0.0rc0, =0.1.0, =0.0.4, =0.1.2, =0.8.0, =0.0.1, =0.0.9, =1.0.16, =0.0.1, =1.10.2, =0.7.0, =0.2.0rc0, =1.0.3, =1.0.0a0.post2, =2.0.0 and more Source cves: CVE-2023-6014 Source advisory: OSV:GHSA-4QQ5-MXXX-M6GG...

autozeekwatch (>=0.1.0, <=0.1.3), azureml-evaluate-mlflow (>=0.0.4, <=0.0.36) +38 more potentially affected by CVE-2023-6014 via mlflow (>=2.0.0rc0, <=2.7.1)

mlflow PYPI version =2.0.0rc0, =0.1.0, =0.0.4, =0.1.2, =0.8.0, =0.0.1, =0.0.9, =1.0.16, =0.0.1, =1.10.2, =0.7.0, =0.2.0rc0, =1.0.3, =1.0.0a0.post2, =2.0.0 and more Source cves: CVE-2023-6014 Source advisory: GHSA-4QQ5-MXXX-M6GG...

a2 (>=0.1.0, <=0.3.17), ikomia (>=0.9.0, <=0.13.0) +2 more potentially affected by CVE-2023-6014 via mlflow (1.30.0)

mlflow PYPI version 1.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - a2 =0.1.0, =0.9.0, =0.13.0 - mantik 0.1.2 - pyrovelocity 0.1.1 Source cves: CVE-2023-6014 Source advisory: OSV:GHSA-4QQ5-MXXX-M6GG...

cnext (>=0.3.5, <=0.3.8), code-first-pipelines (>=0.8.0, <=1.0.0) +51 more potentially affected by CVE-2023-6014 via mlflow (1.30.1)

mlflow PYPI version 1.30.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - cnext =0.3.5, =0.8.0, =0.6.1rc1, =0.2.4, =0.24.24, =0.0.1a0, =1.0.1, =0.1.1, =0.3.0, =0.8.3, =0.48.0, =0.2.0, =0.2.0, =0.3.0 and more Source cves:...

GHSA-4QQ5-MXXX-M6GG MLflow authentication requirement bypass can allow a user to arbitrarily create an account

An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirement...

flown (>=0.0.1, <=0.1.0) potentially affected by CVE-2023-6014 via mlflow (1.17.0)

mlflow PYPI version 1.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - flown =0.0.1, =0.1.0 Source cves: CVE-2023-6014 Source advisory: OSV:GHSA-4QQ5-MXXX-M6GG...