PYSEC-2023-70

vendorUSosv

view advisory published 2023-05-11Licence: CC-BY-4.0

A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path parameter.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-30172US	high7.5	1.00% (63rd)	—	2023-05-11
A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path paramete…

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-wc6j-5g83-xfm6ADVISORY
https://github.com/mlflow/mlflow/issues/7166REPORT
https://github.com/mlflow/mlflow/issues/7166#issuecomment-1541543234REPORT

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan