PyPI/mlflow CVE-2023-30172: unknown, EPSS 1.00%
A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path parameter.
Action: Upgrade mlflow to 2.0.1 or later.
pip install mlflow==2.0.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.1 | - |
Fixed versions
| 2.0.1 |
Sources
- osv: PYSEC-2023-70
- https://github.com/mlflow/mlflow/issues/7166
- https://github.com/mlflow/mlflow/issues/7166#issuecomment-1541543234
- https://github.com/advisories/GHSA-wc6j-5g83-xfm6
CVE-2023-30172 · published · modified · JSON