Arbitrary Code Execution Vulnerability in MLflow Platform
CVE-2024-37052

8.8HIGH

Key Information:

Vendor
Mlflow
Status
Mlflow
Vendor
CVE Published:
4 June 2024

Summary

The MLflow platform is affected by a vulnerability in its handling of data deserialization. This occurs in versions 1.1.0 and newer, where a maliciously uploaded scikit-learn model can exploit this flaw to execute arbitrary code on a user's system when the model is interacted with. This vulnerability highlights the need for developers to implement secure coding practices and for users to maintain updated versions of software to mitigate potential exploitation risks.

Affected Version(s)

MLflow 1.1.0

References

https://hiddenlayer.com/sai-security-advisory/mlflow-june...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.