CVE-2023-6015

Description

MLflow allowed arbitrary files to be PUT onto the server.

Affected packages (2)

• Bitnami/mlflowfrom 0, < 2.8.1
• PyPI/mlflowfrom 0, < 2.8.1

CVSS scores

References (5)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-6015
• PATCHhttps://github.com/mlflow/mlflow
• WEBhttps://github.com/mlflow/mlflow/commit/cf83dad4df26dd4a850622fe8a51ccab1471a5e7
• WEBhttps://github.com/mlflow/mlflow/pull/10330
• WEBhttps://huntr.com/bounties/43e6fb72-676e-4670-a225-15d6836f65d3