PT-2024-30080 · Mlflow · Mlflow
Published
2024-05-16
·
Updated
2025-02-04
·
CVE-2024-4263
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
mlflow/mlflow versions before 2.10.1
Description
A broken access control issue exists, allowing low privilege users with only EDIT permissions on an experiment to delete any artifacts. This occurs due to the lack of proper validation for DELETE requests by users with EDIT permissions, enabling them to perform unauthorized deletions of artifacts. The issue specifically affects the handling of artifact deletions within the application, as demonstrated by the ability of a low privilege user to delete a directory inside an artifact using a DELETE request, despite the official documentation stating that users with EDIT permission can only read and update artifacts, not delete them.
Recommendations
For mlflow/mlflow versions before 2.10.1, update to version 2.10.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of DELETE requests for users with EDIT permissions to minimize the risk of exploitation. Restrict access to the artifact deletion functionality to prevent unauthorized deletions.
Exploit
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mlflow