Advisoriesby IbisMLflowGHSA-4qq5-mxxx-m6gg
MLflow authentication requirement bypass can allow a user to arbitrarily create an account
Fix: upgrade to 2.8.0 or later
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirement.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mlflow PyPI | < 2.8.0 | 2.8.0 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-598
- Also known as
- BIT-mlflow-2023-6014, CVE-2023-6014, PYSEC-2026-415
- nvd.nist.gov/vuln/detail/CVE-2023-6014
- github.com/mlflow/mlflow/issues/9669
- github.com/mlflow/mlflow/pull/9700
- github.com/mlflow/mlflow/commit/32de2154ef9f946160e5dc01a4d8a449dd0bd259
- github.com/mlflow/mlflow
- github.com/mlflow/mlflow/releases/tag/v2.8.0
- huntr.com/bounties/3e64df69-ddc2-463e-9809-d07c24dc1de4
More MLflow advisories
All MLflow
Path traversal in MLflowCVE-2023-6753fixed in 2.9.2Jinja2 template injection in mlflowCVE-2023-6709fixed in 2.9.2Cross-site Scripting (XSS) in MLflowCVE-2023-6568fixed in 2.9.0Information exposure in MLflowCVE-2023-43472fixed in 2.9.0Remote Code Execution due to Full Controled File Write in mlflowCVE-2023-6018fixed in 2.9.2MLflow allowed arbitrary files to be PUT onto the serverCVE-2023-6015fixed in 2.8.1