Arbitrary Code Execution Vulnerability in MLflow Platform
CVE-2024-37055

8.8HIGH

Key Information:

Vendor

Mlflow

Status
Mlflow
Vendor
CVE Published:
4 June 2024

What is CVE-2024-37055?

A vulnerability exists in the MLflow platform, specifically in versions 1.24.0 and newer, where deserialization of untrusted data can occur. This vulnerability enables the execution of arbitrary code on an end user’s system when interacting with a maliciously uploaded pmdarima model. As a result, attackers can exploit this flaw to run harmful code, potentially compromising the integrity and security of the system.

Affected Version(s)

MLflow 1.24.0

References

https://hiddenlayer.com/sai-security-advisory/mlflow-june...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.