GHSA-wc6j-5g83-xfm6
mflow vulnerable to directory traversal
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
A directory traversal vulnerability in the /get-artifact API method of the mlflow platform prior to v2.0.0 allows attackers to read arbitrary files on the server via the path parameter.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2023-30172
- https://github.com/mlflow/mlflow/issues/7166
- https://github.com/mlflow/mlflow/issues/7166#issuecomment-1541543234
- https://github.com/mlflow/mlflow/pull/7170
- https://github.com/mlflow/mlflow/commit/ac4b697bb0bb8a331944dca63f4235b4bf602ab8
- https://github.com/mlflow/mlflow
- https://github.com/mlflow/mlflow/commits/v2.0.0?after=00c3b0a350a28c25b16fbb7feddb8147a919ce18+69&branch=v2.0.0&qualified_name=refs%2Ftags%2…
- https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2023-70.yaml