PT-2023-21350 · Mlflow · Mlflow
Publicado
2023-05-17
·
Atualizado
2024-03-06
·
CVE-2023-2780
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
mlflow versions prior to 2.3.1
Description
The issue is related to path traversal, where the sequence '..filename' can be used to bypass security restrictions. This allows unauthorized access to files and directories outside the intended directory. The estimated number of potentially affected devices is not provided. There is no information about real-world incidents where this issue was exploited. Technical details include the use of the '..filename' sequence to exploit the path traversal weakness.
Recommendations
For versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.
Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Mlflow