Serena Ruan

3 exploits Active since Jul 2023
CVE-2023-3765 WRITEUP CRITICAL WRITEUP
MLflow < 2.5.0 - Absolute Path Traversal
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.
CVSS 10.0
CVE-2023-4033 WRITEUP HIGH WRITEUP
mlflow/mlflow <2.6.0 - Command Injection
OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0.
CVSS 7.8
CVE-2024-3573 WRITEUP CRITICAL WRITEUP
MLflow < 2.10.0 - Local File Inclusion via URI Scheme Parsing Bypass
mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the 'is_local_uri' function's failure to properly handle URIs with empty or 'file' schemes, leading to the misclassification of URIs as non-local. Attackers can exploit this by crafting malicious model versions with specially crafted 'source' parameters, enabling the reading of sensitive files within at least two directory levels from the server's root.
CVSS 9.3