GHSA-4qq5-mxxx-m6gg
Suggest an improvement- Source
- https://github.com/advisories/GHSA-4qq5-mxxx-m6gg
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-4qq5-mxxx-m6gg/GHSA-4qq5-mxxx-m6gg.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-4qq5-mxxx-m6gg
- Aliases
-
- BIT-mlflow-2023-6014
- CVE-2023-6014
- Published
- 2023-11-16T21:30:46Z
- Modified
- 2024-03-01T21:31:07.509383Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- MLflow authentication requirement bypass can allow a user to arbitrarily create an account
- Details
-
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirement.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2023-6014
- https://github.com/mlflow/mlflow/issues/9669
- https://github.com/mlflow/mlflow/pull/9700
- https://github.com/mlflow/mlflow/commit/32de2154ef9f946160e5dc01a4d8a449dd0bd259
- https://github.com/mlflow/mlflow
- https://github.com/mlflow/mlflow/releases/tag/v2.8.0
- https://huntr.com/bounties/3e64df69-ddc2-463e-9809-d07c24dc1de4
Affected packages
PyPI / mlflow
Package
- Name
- mlflow
- View open source insights on deps.dev
- Purl
- pkg:pypi/mlflow
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.8.0
Affected versions
0.*
0.0.1
0.1.0
0.2.0
0.2.1
0.3.0
0.4.0
0.4.1
0.4.2
0.5.0
0.5.1
0.5.2
0.6.0
0.7.0
0.8.0
0.8.1
0.8.2
0.9.0
0.9.0.1
0.9.1
1.*
1.0.0
1.1.0
1.1.1.dev0
1.2.0
1.3.0
1.4.0
1.5.0
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.9.0
1.9.1
1.10.0
1.11.0
1.12.0
1.12.1
1.13
1.13.1
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.20.0
1.20.1
1.20.2
1.21.0
1.22.0
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.26.0
1.26.1
1.27.0
1.28.0
1.29.0
1.30.0
1.30.1
2.*
2.0.0rc0
2.0.0
2.0.1
2.1.0
2.1.1
2.2.0
2.2.1
2.2.2
2.3.0
2.3.1
2.3.2
2.4.0
2.4.1
2.4.2
2.5.0
2.6.0
2.7.0
2.7.1