PT-2023-32782 · Mlflow · Mlflow

B-Step62 · Publicado 2023-12-14 · Atualizado 2024-03-06 · CVE-2023-6831

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions mlflow/mlflow versions prior to 2.9.2

Description The issue is related to a Path Traversal vulnerability, where the sequence '..filename' can be used to access files outside the intended directory. This vulnerability is present in the mlflow/mlflow GitHub repository.

Recommendations For versions prior to 2.9.2, update to version 2.9.2 or later to resolve the issue.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

CWE-29

Identificadores relacionados

BIT-MLFLOW-2023-6831

CVE-2023-6831

GHSA-554W-XH4J-8W64

PYSEC-2023-253

Produtos afetados

Mlflow

Referências · 14

• 🔥 https://huntr.com/bounties/0acdd745-0167-4912-9d5c-02035fe5b314 · Exploit
• https://github.com/mlflow/mlflow · Nota
• https://github.com/mlflow/mlflow/commit/1da75dfcecd4d169e34809ade55748384e8af6c1 · Correção
• https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2023-253.yaml · Nota
• https://twitter.com/Checkmarx/status/1737054350361456768 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-554w-xh4j-8w64 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-6831 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1735550291225817403 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1735466416730501252 · Publicação no Twitter
• https://t.me/cvenotify/71343 · Publicação no Telegram
• https://osv.dev/vulnerability/BIT-mlflow-2023-6831 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2023-253 · Aviso do Fabricante
• https://twitter.com/digital_const/status/1748863606110753015 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-6831 · Aviso do Fabricante