PT-2024-22849 · Mlflow · Mlflow
Published
2024-06-06
·
Updated
2025-05-15
·
CVE-2024-2928
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
mlflow/mlflow versions 2.9.2 through 2.11.2
Description
A Local File Inclusion (LFI) issue was identified, arising from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like '/etc/passwd'. This vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI's query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks.
Recommendations
For versions 2.9.2 through 2.11.2, update to version 2.11.3 to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and implementing comprehensive validation of all parts of a URI to prevent LFI attacks.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Mlflow