GitHub Advisoryadvisory · PyPI

GHSA-59v3-898r-qwhj MLflow Server-Side Request Forgery (SSRF)

CRITICAL Published 2023-12-20 Modified 2024-01-02 Official page ↗
Aliases
CVE-2023-6974
Ecosystem
PyPI
Packages
mlflow
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-918
Reviewed
2023-12-20

Affected packages

• PyPI mlflow: < 2.9.2 → fixed in 2.9.2

Description

A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abused to get a remote code execution on the victim machine.

Related

Alias · CVE (1)

  • CVE-2023-6974 A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abuse to get… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References