logo

Database

Server side cross-site scripting In mlflow

Description

MLFlow Cross-site Scripting vulnerability leads to client-side Remote Code Execution Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. This issue leads to a client-side RCE when running the recipe in Jupyter Notebook. The vulnerability stems from lack of sanitization over dataset table fields.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2024-271332. NVD-2024-271333. OSV-2024-271334. GCVE-2024-27133

References

1. https://github.com/mlflow/mlflow/pull/108932. https://github.com/mlflow/mlflow/commit/c43823750bffa5b6abcc086683b15a068513b67b3. https://github.com/mlflow/mlflow/commit/cfa71879a884cc3520e23ccab998c9aa78fdf2b14. https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2024-241.yaml5. https://research.jfrog.com/vulnerabilities/mlflow-untrusted-dataset-xss-jfsa-2024-000631932

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.