MLflow allowed arbitrary files to be PUT onto the server.
References
Link | Resource |
---|---|
https://huntr.com/bounties/43e6fb72-676e-4670-a225-15d6836f65d3 | Exploit Third Party Advisory |
Configurations
History
29 Nov 2023, 18:10
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-11-16 16:15
Updated : 2024-02-05 00:22
NVD link : CVE-2023-6015
Mitre link : CVE-2023-6015
CVE.ORG link : CVE-2023-6015
JSON object : View
Products Affected
lfprojects
- mlflow
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')