logo

Database

Lack of data validation - Path Traversal In mlflow

Description

MLflow Path Traversal vulnerability Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2023-37652. NVD-2023-37653. OSV-2023-37654. GCVE-2023-3765

References

1. https://github.com/mlflow/mlflow/commit/6dde93758d42455cb90ef324407919ed67668b9b2. https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2023-308.yaml3. https://huntr.dev/bounties/4be5fd63-8a0a-490d-9ee1-f33dc768ed764. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3765.yaml

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.