CVE-2023-6976

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-6976
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-6976.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-6976
Aliases
Published
2023-12-20T05:30:08.540Z
Modified
2026-07-22T02:50:44.217902Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Unrestricted Upload of File with Dangerous Type
Details

This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6976.json",
    "cwe_ids": [
        "CWE-434"
    ],
    "cna_assigner": "@huntr_ai"
}
References

Affected packages

Git / github.com/mlflow/mlflow

Affected ranges

Type
GIT
Repo
https://github.com/mlflow/mlflow
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6ca72469b289e77acc2f1201ca39237fc025c090
Fixed
5044878da0c1851ccfdd5c0a867157ed9a502fbc
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.9.2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*"
}

Affected versions

1.*
1.0.0
v0.*
v0.2.0
v0.2.1
v0.3.0
v0.4.0
v0.4.1
v0.4.2
v0.5.0
v0.6.0
v0.7
v0.8.0
v0.8.1
v1.*
v1.7.0
v2.*
v2.2.0
v2.9.0
v2.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-6976.json"
vanir_signatures_modified 
"2026-07-22T02:50:44Z"
vanir_signatures 
[
    {
        "digest": {
            "function_hash": "41577576781758645994132782347271038383",
            "length": 482.0
        },
        "id": "CVE-2023-6976-264721b0",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/mlflow/mlflow/commit/6ca72469b289e77acc2f1201ca39237fc025c090",
        "signature_type": "Function",
        "target": {
            "function": "testScoringServerWithValidPredictorRespondsToVersionCorrectly",
            "file": "mlflow/java/scoring/src/test/java/org/mlflow/ScoringServerTest.java"
        }
    },
    {
        "digest": {
            "line_hashes": [
                "196573444960829707875320866494714691261",
                "271948446609272190247368243181800837017",
                "53471754088520627507579338316850690467",
                "33278243910103464003635330866461910749"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2023-6976-3b2c929e",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/mlflow/mlflow/commit/6ca72469b289e77acc2f1201ca39237fc025c090",
        "signature_type": "Line",
        "target": {
            "file": "mlflow/java/scoring/src/main/java/org/mlflow/sagemaker/ScoringServer.java"
        }
    },
    {
        "digest": {
            "line_hashes": [
                "309731809211771193513369395030748044361",
                "114807972603507761925102257914653220858",
                "54242903575207562870989186276313247961",
                "128921726128245671312574701825963265888"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2023-6976-708d66a9",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/mlflow/mlflow/commit/6ca72469b289e77acc2f1201ca39237fc025c090",
        "signature_type": "Line",
        "target": {
            "file": "mlflow/java/scoring/src/test/java/org/mlflow/ScoringServerTest.java"
        }
    },
    {
        "digest": {
            "function_hash": "9624725844488257082857400704039181297",
            "length": 188.0
        },
        "id": "CVE-2023-6976-e5d1dbd1",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/mlflow/mlflow/commit/6ca72469b289e77acc2f1201ca39237fc025c090",
        "signature_type": "Function",
        "target": {
            "function": "doGet",
            "file": "mlflow/java/scoring/src/main/java/org/mlflow/sagemaker/ScoringServer.java"
        }
    }
]