Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS00cXE1LW14eHgtbTZnZ84AA3Oh

MLflow authentication requirement bypass can allow a user to arbitrarily create an account

An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirement.

Permalink: https://github.com/advisories/GHSA-4qq5-mxxx-m6gg
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00cXE1LW14eHgtbTZnZ84AA3Oh
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: 12 days ago
Updated: 8 days ago

CVSS Score: 9.1
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Identifiers: GHSA-4qq5-mxxx-m6gg, CVE-2023-6014
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-6014
• https://huntr.com/bounties/3e64df69-ddc2-463e-9809-d07c24dc1de4
• https://github.com/mlflow/mlflow/issues/9669
• https://github.com/advisories/GHSA-4qq5-mxxx-m6gg

Affected Packages