Sensitive File Disclosure in mlflow
Summary
CVE-2023-6977: Path Traversal: '\..\filename'. Affects mlflow versions >= 1.0.0, < 2.9.2. Fixed in 2.9.2. How to fix ↓
Also tracked for
The same CVE-2023-6977 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mlflow is an open-source platform for managing and tracking machine learning experiments. It provides a centralized repository for storing and organizing machine learning models, along with tools for tracking experiments and reproducing results. However, a vulnerability has been identified in mlflow that allows malicious users to read sensitive files on the server.
Vulnerability Detail
This vulnerability in mlflow enables attackers to access sensitive files on the server. By exploiting this vulnerability, an attacker can gain unauthorized access to files containing sensitive information, such as configuration files, database credentials, or other confidential data. This can lead to further compromise of the system and potential data breaches.
How To Fix
Minimum fixed version
2.9.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the latest version of mlflow.
Conclusion
In conclusion, the vulnerability in mlflow allows unauthorized access to sensitive files on the server. It is crucial to upgrade to the latest version of mlflow to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mlflow →
FAQ
mlflow is an open-source platform for managing and tracking machine learning experiments.
This vulnerability allows attackers to read sensitive files on the server, potentially leading to unauthorized access and data breaches.
To fix this vulnerability, upgrade mlflow to version 2.9.2 or later.
No, there is no known workaround for this vulnerability. Upgrading to the latest version is the recommended solution.
You can find more information about this vulnerability in the mlflow vulnerability database.
References
Related vulnerabilities
Recent vulnerabilities recorded for mlflow.
