PT-2024-22849 · Mlflow · Mlflow

Published

2024-06-06

·

Updated

2025-05-15

·

CVE-2024-2928

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions mlflow/mlflow versions 2.9.2 through 2.11.2
Description A Local File Inclusion (LFI) issue was identified, arising from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like '/etc/passwd'. This vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI's query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks.
Recommendations For versions 2.9.2 through 2.11.2, update to version 2.11.3 to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and implementing comprehensive validation of all parts of a URI to prevent LFI attacks.

Exploit

Fix

Path traversal

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BIT-MLFLOW-2024-2928
CVE-2024-2928
GHSA-J46Q-5PXX-8VMW
PYSEC-2024-242

Affected Products

Mlflow