logo

Database

Lack of data validation - Path Traversal In mlflow

Description

Relative path traversal in mlflow Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2023-23562. NVD-2023-23563. OSV-2023-23564. GCVE-2023-2356

References

1. https://github.com/mlflow/mlflow/commit/f73147496e05c09a8b83d95fb4f1bf86696c63422. https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2023-68.yaml3. https://huntr.dev/bounties/7b5d130d-38eb-4133-8c7d-0dfc9a9d98964. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-2356.yaml

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.