Lucene search

Veracode Vulnerability DatabaseVERACODE:47539

HistoryJun 14, 2024 - 5:37 a.m.

Code Injection

2024-06-1405:37:45

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

mlflow

code injection

input validation

projects/backend/local.py

arbitrary code

mlproject file

software

vulnerability

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

mlflow is vulnerable to Code Injection. The vulnerability is caused due to improper input validation in the _run_entry_point function within the projects/backend/local.py file. This vulnerability allows an attacker to execute arbitrary code on the victim’s system by submitting a maliciously crafted MLproject file.

CPENameOperatorVersion
mlflowle2.14.0rc0
mlflowle2.14.0rc0

CPE	Name	Operator	Version
	mlflow	le	2.14.0rc0
	mlflow	le	2.14.0rc0

References

github.com/advisories/GHSA-pqcv-qw2r-r859

hiddenlayer.com/sai-security-advisory/mlflow-june2024/

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for VERACODE:47539