GHSA-hq88-wg7q-gp4g

Source

https://github.com/advisories/GHSA-hq88-wg7q-gp4g

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-hq88-wg7q-gp4g/GHSA-hq88-wg7q-gp4g.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-hq88-wg7q-gp4g

Aliases

Published

2024-04-16T00:30:34Z

Modified

2025-02-04T08:11:58.301267Z

Severity

9.3 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N CVSS Calculator

Summary

mlflow vulnerable to Path Traversal

Details

mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the 'islocaluri' function's failure to properly handle URIs with empty or 'file' schemes, leading to the misclassification of URIs as non-local. Attackers can exploit this by crafting malicious model versions with specially crafted 'source' parameters, enabling the reading of sensitive files within at least two directory levels from the server's root.

Database specific

{
    "nvd_published_at": "2024-04-16T00:15:12Z",
    "cwe_ids": [
        "CWE-29"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-16T18:20:36Z"
}

References

Affected packages

PyPI / mlflow

Package

Name: mlflow; View open source insights on deps.dev
Purl: pkg:pypi/mlflow

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.10.0

Affected versions

0.*

0.0.1

0.1.0

0.2.0

0.2.1

0.3.0

0.4.0

0.4.1

0.4.2

0.5.0

0.5.1

0.5.2

0.6.0

0.7.0

0.8.0

0.8.1

0.8.2

0.9.0

0.9.0.1

0.9.1

1.*

1.0.0

1.1.0

1.1.1.dev0

1.2.0

1.3.0

1.4.0

1.5.0

1.6.0

1.7.0

1.7.1

1.7.2

1.8.0

1.9.0

1.9.1

1.10.0

1.11.0

1.12.0

1.12.1

1.13

1.13.1

1.14.0

1.14.1

1.15.0

1.16.0

1.17.0

1.18.0

1.19.0

1.20.0

1.20.1

1.20.2

1.21.0

1.22.0

1.23.0

1.23.1

1.24.0

1.25.0

1.25.1

1.26.0

1.26.1

1.27.0

1.28.0

1.29.0

1.30.0

1.30.1

2.*

2.0.0rc0

2.0.0

2.0.1

2.1.0

2.1.1

2.2.0

2.2.1

2.2.2

2.3.0

2.3.1

2.3.2

2.4.0

2.4.1

2.4.2

2.5.0

2.6.0

2.7.0

2.7.1

2.8.0

2.8.1

2.9.0

2.9.1

2.9.2