CVE-2024-37061

2024-06-0412:02:23

CWE-94

HiddenLayer

github.com

cve-2024-37061

mlflow platform

remote code execution

arbitrary code

mlproject

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation

poc

Automatable

Technical Impact

total

JSON

Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*"
    ],
    "vendor": "lfprojects",
    "product": "mlflow",
    "versions": [
      {
        "status": "affected",
        "version": "1.11.0",
        "versionType": "semver",
        "lessThanOrEqual": "*"
      }
    ],
    "defaultStatus": "unknown"
  }
]