PT-2023-32831 · Lfprojects+4 · Mlflow+1

Harupy · Published 2023-12-19 · Updated 2024-03-06 · CVE-2023-6975

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-29

Related Identifiers

BIT-MLFLOW-2023-6975

CVE-2023-6975

GHSA-HH8P-P8MP-GQHM

Affected Products

Mlflow

Mlflow/Mlflow

References · 12

• 🔥 https://huntr.com/bounties/029a3824-cee3-4cf1-b260-7138aa539b85 · Exploit
• https://github.com/mlflow/mlflow/commit/b9ab9ed77e1deda9697fe472fb1079fd428149ee · Patch
• https://osv.dev/vulnerability/BIT-mlflow-2023-6975 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6975 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6975 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hh8p-p8mp-gqhm · Vendor Advisory
• https://github.com/mlflow/mlflow · Note
• https://t.me/cvenotify/65701 · Telegram Post
• https://twitter.com/CVEnew/status/1737346432846401744 · Twitter Post
• https://twitter.com/Checkmarx/status/1739892022599614557 · Twitter Post
• https://t.me/cvenotify/64355 · Telegram Post
• https://t.me/cvenotify/70308 · Telegram Post