Information Disclosure

2022-02-2410:08:41

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

38.1%

JSON

mlflow is vulnerable to information disclosure. The vulnerability exists due to lack of sanitization in the tempfile.mktemp' function in file_utils.py`file allows to create same name temporary files in a different process.

CPENameOperatorVersion
mlflowle1.23.0
mlflowle1.23.0

CPE	Name	Operator	Version
	mlflow	le	1.23.0
	mlflow	le	1.23.0

References

github.com/advisories/GHSA-vqj2-4v8m-8vrq

github.com/mlflow/mlflow/commit/61984e6843d2e59235d82a580c529920cd8f3711

github.com/mlflow/mlflow/pull/5303

huntr.dev/bounties/e5384764-c583-4dec-a1d8-4697f4e12f75

0.001 Low

EPSS

Percentile

38.1%

JSON

Related for VERACODE:34366