Path Traversal Vulnerability in mlflow Repository

CVE-2024-1593

Summary

A path traversal vulnerability exists in the Mlflow repository due to improper handling of URL parameters. Attackers can exploit this vulnerability by using the ';' character within URLs to manipulate the 'params' portion, which grants them unauthorized access to restricted files or directories on the server. This exploitation allows for arbitrary data smuggling into the URL parameters, potentially leading to serious consequences such as unauthorized information disclosure or server compromise. Organizations using affected versions of Mlflow are advised to implement appropriate security measures to mitigate the risk associated with this vulnerability.

References