CVE-2023-6018

Name of the Vulnerable Software and Affected Versions MLflow (affected versions not specified)

Description The issue allows an attacker to overwrite any file on the server hosting MLflow without authentication. This gives multiple ways to achieve code execution, such as overwriting /home/<user>/.bashrc. A malicious user could exploit this to get command execution on the vulnerable machine and access data and models information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.