PT-2023-32831 · Lfprojects+4 · Mlflow+1

Harupy · Publicado 2023-12-19 · Atualizado 2024-03-06 · CVE-2023-6975

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-29

Identificadores relacionados

BIT-MLFLOW-2023-6975

CVE-2023-6975

GHSA-HH8P-P8MP-GQHM

Produtos afetados

Mlflow

Mlflow/Mlflow

Referências · 12

• 🔥 https://huntr.com/bounties/029a3824-cee3-4cf1-b260-7138aa539b85 · Exploit
• https://github.com/mlflow/mlflow · Nota
• https://github.com/mlflow/mlflow/commit/b9ab9ed77e1deda9697fe472fb1079fd428149ee · Correção
• https://twitter.com/Checkmarx/status/1739892022599614557 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-6975 · Nota de Segurança
• https://t.me/cvenotify/64355 · Publicação no Telegram
• https://t.me/cvenotify/65701 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-hh8p-p8mp-gqhm · Aviso do Fabricante
• https://t.me/cvenotify/70308 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1737346432846401744 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-mlflow-2023-6975 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-6975 · Aviso do Fabricante