by Kastro
Paper/Archive/CVE-2023-2356

CVE-2023-2356

mlflow mlflow/mlflow — Relative Path Traversal in mlflow/mlflow

EPSS 4%public exploitCVSS 10.0
critical.is priorityof 100
58
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 90.9.909 × 2018.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.

Affected

ProductAffectedFixed inSource
mlflow/mlflowunspecified – < 2.3.12.3.1CNA

Scores by source

@huntrdev (CNA)10.0CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refhuntr.dev/bounties/7b5d130d-38eb-4133-8c7d-0dfc9a9d9896refgithub.com/mlflow/mlflow/commit/f73147496e05c09a8b83d95fb4f1bf86696c6342