Path Traversal: '\..\filename' in mlflow/mlflow
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1.
- Actualiza a 2.3.0
- Actualiza a 2.3.1
Publicación Actualización
PatchFirst · Vulnerabilidades recientes
Vulnerabilidades de mlflow · Página 5
Vulnerabilidades publicadas para mlflow en los últimos 30 días: 5. Incluidas en el catálogo KEV: 0.
Vulnerabilidades: 87
CVE-2023-30172
A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path parameter.
- Actualiza a 2.0.0rc0
- Actualiza a 2.0.1
Publicación ActualizaciónRemote file access vulnerability in `mlflow server` and `mlflow ui` CLIs
### Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the ``mlflow server`` or ``mlflow ui`` commands using an MLflow version older than **MLflow 2.3.1** may be vulnerable to a remote file access exploit if they are not limiting who can query their server (for example, by using a cloud VPC, an IP allowlist for inbound requests, or authentication / authorization middleware). This issue only affects users and integrations that run the ``mlflow server`` and ``mlflow ui`` commands. Integrations that do not make use of ``mlflow server`` or ``mlflow ui`` are unaffected; for example, the Databricks Mana
- Actualiza a 2.3.1
Publicación ActualizaciónRelative Path Traversal in mlflow/mlflow
Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.
- Actualiza a 2.3.1
Publicación ActualizaciónPath Traversal: '\..\filename' in mlflow/mlflow
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.
- Actualiza a 2.2.1
Publicación ActualizaciónAbsolute Path Traversal in mlflow/mlflow
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2.
- Actualiza a 2.2.1
- Actualiza a 2.2.2
Publicación ActualizaciónInsecure Temporary File in mlflow/mlflow
Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.
- Actualiza a 1.23.1
Publicación Actualización
Comprueba tu servidor
Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.