GHSA-wc6j-5g83-xfm6

Source

https://github.com/advisories/GHSA-wc6j-5g83-xfm6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-wc6j-5g83-xfm6/GHSA-wc6j-5g83-xfm6.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-wc6j-5g83-xfm6

Aliases

Published

2023-05-11T03:30:15Z

Modified

2023-12-06T00:47:57.019929Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

mflow vulnerable to directory traversal

Details

A directory traversal vulnerability in the /get-artifact API method of the mlflow platform prior to v2.0.0 allows attackers to read arbitrary files on the server via the path parameter.

Database specific

{
    "nvd_published_at": "2023-05-11T02:15:08Z",
    "cwe_ids": [
        "CWE-22"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-05-11T20:11:04Z"
}

References

Affected packages

PyPI / mlflow

Package

Name: mlflow; View open source insights on deps.dev
Purl: pkg:pypi/mlflow

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0.0rc0

Affected versions

0.*

0.0.1

0.1.0

0.2.0

0.2.1

0.3.0

0.4.0

0.4.1

0.4.2

0.5.0

0.5.1

0.5.2

0.6.0

0.7.0

0.8.0

0.8.1

0.8.2

0.9.0

0.9.0.1

0.9.1

1.*

1.0.0

1.1.0

1.1.1.dev0

1.2.0

1.3.0

1.4.0

1.5.0

1.6.0

1.7.0

1.7.1

1.7.2

1.8.0

1.9.0

1.9.1

1.10.0

1.11.0

1.12.0

1.12.1

1.13

1.13.1

1.14.0

1.14.1

1.15.0

1.16.0

1.17.0

1.18.0

1.19.0

1.20.0

1.20.1

1.20.2

1.21.0

1.22.0

1.23.0

1.23.1

1.24.0

1.25.0

1.25.1

1.26.0

1.26.1

1.27.0

1.28.0

1.29.0

1.30.0

1.30.1