logo

Database

Lack of data validation In mlflow

Description

MLflow Path Traversal Vulnerability Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2023-69092. NVD-2023-69093. OSV-2023-69094. GCVE-2023-6909

References

1. https://github.com/mlflow/mlflow/commit/1da75dfcecd4d169e34809ade55748384e8af6c12. https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2023-252.yaml3. https://huntr.com/bounties/11209efb-0f84-482f-add0-587ea6b7e8504. https://vulncheck.com/cve/CVE-2023-69095. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6909.yaml

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.