CVE-2024-8859

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-8859
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the path part of the URL is checked, while parts such as query and parameters are not handled. The vulnerability is triggered if the user has configured the dbfs service, and during usage, the service is mounted to a local directory.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/mlflow/mlflow/commit/7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 Patch
https://huntr.com/bounties/2259b88b-a0c6-4c7c-b434-6aacf6056dcb Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:lfprojects:mlflow:2.15.1:*:*:*:*:*:*:*
History

05 Aug 2025, 16:15

Type Values Removed Values Added
Summary
  • (es) Existe una vulnerabilidad de path traversal en mlflow/mlflow versión 2.15.1. Cuando los usuarios configuran y utilizan el servicio dbfs, la concatenación de la URL directamente en el protocolo de archivo genera una vulnerabilidad de lectura de archivos arbitrarios. Este problema se produce porque solo se verifica la parte de la ruta de la URL, mientras que partes como la consulta y los parámetros no se gestionan. La vulnerabilidad se activa si el usuario ha configurado el servicio dbfs y, durante su uso, este se monta en un directorio local.
References () https://github.com/mlflow/mlflow/commit/7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 - () https://github.com/mlflow/mlflow/commit/7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 - Patch
References () https://huntr.com/bounties/2259b88b-a0c6-4c7c-b434-6aacf6056dcb - () https://huntr.com/bounties/2259b88b-a0c6-4c7c-b434-6aacf6056dcb - Exploit, Third Party Advisory
CPE cpe:2.3:a:lfprojects:mlflow:2.15.1:*:*:*:*:*:*:*
First Time Lfprojects mlflow
Lfprojects

20 Mar 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-20 10:15

Updated : 2025-08-05 16:15

NVD link : CVE-2024-8859

Mitre link : CVE-2024-8859

CVE.ORG link : CVE-2024-8859

JSON object : View

Products Affected

lfprojects

  • mlflow
CWE
CWE-29

Path Traversal: '\..\filename'