MLflowGHSA-cxfr-5q3r-2rc2
Jinja2 template injection in mlflow
High8.8CVE-2023-6709 · Published Dec 12, 2023 · updated Nov 22, 2024
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mlflow PyPI | < 2.9.2 | 2.9.2 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-1336
- Also known as
- BIT-mlflow-2023-6709, CVE-2023-6709, PYSEC-2023-281
More MLflow advisories
All MLflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Dec 202023 | MLflow Path Traversal Vulnerability High8.8Dec 20, 2023 | High8.8 | 2.9.2 |
| Dec 192023 | mlflow Command Injection vulnerabilityHigh8.8Dec 19, 2023 | High8.8 | 2.9.2 |
| Dec 152023 | Path traversal in MLflowCritical10.0Dec 15, 2023 | Critical10.0 | 2.9.2 |
| Dec 132023 | Path traversal in MLflowHigh8.8Dec 13, 2023 | High8.8 | 2.9.2 |
| Dec 72023 | Cross-site Scripting (XSS) in MLflowMedium6.5Dec 7, 2023 | Medium6.5 | 2.9.0 |
| Dec 52023 | Information exposure in MLflowHigh7.5Dec 5, 2023 | High7.5 | 2.9.0 |