Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
veracodeVeracode Vulnerability DatabaseVERACODE:44743
HistoryDec 19, 2023 - 8:40 a.m.

Directory Traversal

2023-12-1908:40:14
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
8
mlflow
directory traversal
vulnerability
validate_path_is_safe
uri.py
attacker
read
write
crafted file path
restricted directory

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.6 Medium

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.3%

JSON

mlflow is vulnerable to Directory Traversal. The vulnerability exists in the validate_path_is_safe function within uri.py which allows an attacker to read or write to files outside of the restricted directory using a crafted file path.

CPENameOperatorVersion
mlflowle2.9.1
mlflowle2.9.1

Related

cve 3
github 3
osv 7
prion 1
nvd 3
cvelist 3
nuclei 1
vulnrichment 1
cve
cve
CVE-2023-6909
2023-12-18 04:15:52
CVE-2024-3848
2024-05-16 09:15:14
CVE-2024-1594
2024-04-16 00:15:09
github
github
MLflow Path Traversal Vulnerability
2023-12-20 06:30:25
mlflow vulnerable to Path Traversal
2024-04-16 00:30:33
MLflow has a Local File Read/Path Traversal bypass
2024-05-16 09:33:08
osv
osv
CVE-2023-6909
2023-12-18 04:15:52
MLflow Path Traversal Vulnerability
2023-12-20 06:30:25
PYSEC-2023-252
2023-12-18 04:15:00
prion
prion
Path traversal
2023-12-18 04:15:00
nvd
nvd
CVE-2023-6909
2023-12-18 04:15:52
CVE-2024-1594
2024-04-16 00:15:09
CVE-2024-3848
2024-05-16 09:15:14
cvelist
cvelist
CVE-2023-6909 Path Traversal: '\..\filename' in mlflow/mlflow
2023-12-18 00:00:31
CVE-2024-1594 Local File Read via Path Traversal in mlflow/mlflow
2024-04-16 00:00:14
CVE-2024-3848 Path Traversal Bypass in mlflow/mlflow
2024-05-16 09:03:47
nuclei
nuclei
Mlflow <2.9.2 - Path Traversal
2024-02-02 10:20:55
vulnrichment
vulnrichment
CVE-2024-1594 Local File Read via Path Traversal in mlflow/mlflow
2024-04-16 00:00:14

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.6 Medium

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.3%

JSON
Related for VERACODE:44743
cve3github3osv7prion1nvd3cvelist3nuclei1vulnrichment1