Path Traversal Vulnerability in MLflow Product by Databricks

CVE-2024-8859

What is CVE-2024-8859?

A path traversal vulnerability has been identified in MLflow version 2.15.1 developed by Databricks. This vulnerability occurs when users configure and utilize the DBFS service, allowing an attacker to read arbitrary files. The issue arises due to inadequate validation of the URL; only the path portion is checked, leaving other components, such as query strings and parameters, unverified. The vulnerability is provoked if the DBFS service is mounted to a local directory during its use.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References