GHSA-4rj2-9gcx-5qhx

Source

https://github.com/advisories/GHSA-4rj2-9gcx-5qhx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-4rj2-9gcx-5qhx/GHSA-4rj2-9gcx-5qhx.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4rj2-9gcx-5qhx

Aliases

Published

2025-03-20T12:32:53Z

Modified

2025-03-28T08:46:00.998581Z

Severity

3.8 (Low) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

MLflow has Weak Password Requirements

Details

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.

Database specific

{
    "nvd_published_at": "2025-03-20T10:15:54Z",
    "cwe_ids": [
        "CWE-521"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-21T23:36:26Z"
}

References

Affected packages

PyPI / mlflow

Package

Name: mlflow; View open source insights on deps.dev
Purl: pkg:pypi/mlflow

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.19.0

Affected versions

0.*

0.0.1

0.1.0

0.2.0

0.2.1

0.3.0

0.4.0

0.4.1

0.4.2

0.5.0

0.5.1

0.5.2

0.6.0

0.7.0

0.8.0

0.8.1

0.8.2

0.9.0

0.9.0.1

0.9.1

1.*

1.0.0

1.1.0

1.1.1.dev0

1.2.0

1.3.0

1.4.0

1.5.0

1.6.0

1.7.0

1.7.1

1.7.2

1.8.0

1.9.0

1.9.1

1.10.0

1.11.0

1.12.0

1.12.1

1.13

1.13.1

1.14.0

1.14.1

1.15.0

1.16.0

1.17.0

1.18.0

1.19.0

1.20.0

1.20.1

1.20.2

1.21.0

1.22.0

1.23.0

1.23.1

1.24.0

1.25.0

1.25.1

1.26.0

1.26.1

1.27.0

1.28.0

1.29.0

1.30.0

1.30.1

2.*

2.0.0rc0

2.0.0

2.0.1

2.1.0

2.1.1

2.2.0

2.2.1

2.2.2

2.3.0

2.3.1

2.3.2

2.4.0

2.4.1

2.4.2

2.5.0

2.6.0

2.7.0

2.7.1

2.8.0

2.8.1

2.9.0

2.9.1

2.9.2

2.10.0

2.10.1

2.10.2

2.11.0

2.11.1

2.11.2

2.11.3

2.11.4

2.12.0

2.12.1

2.12.2

2.13.0

2.13.1

2.13.2

2.14.0rc0

2.14.0

2.14.1

2.14.2.dev0

2.14.2

2.14.3

2.15.0rc0

2.15.0

2.15.1

2.16.0

2.16.1

2.16.2

2.17.0rc0

2.17.0

2.17.1

2.17.2

2.18.0rc0

2.18.0

2.19.0rc0