Path Traversal: '\..\filename' in mlflow/mlflow
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1.
- Обновитесь до 2.3.0
- Обновитесь до 2.3.1
Опубликовано Обновлено
PatchFirst · Свежие уязвимости
Уязвимости mlflow · Страница 5
За последние 30 дней в mlflow опубликовано уязвимостей: 5; в каталоге KEV: 0.
Уязвимостей: 87
CVE-2023-30172
A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path parameter.
- Обновитесь до 2.0.0rc0
- Обновитесь до 2.0.1
Опубликовано ОбновленоRemote file access vulnerability in `mlflow server` and `mlflow ui` CLIs
### Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the ``mlflow server`` or ``mlflow ui`` commands using an MLflow version older than **MLflow 2.3.1** may be vulnerable to a remote file access exploit if they are not limiting who can query their server (for example, by using a cloud VPC, an IP allowlist for inbound requests, or authentication / authorization middleware). This issue only affects users and integrations that run the ``mlflow server`` and ``mlflow ui`` commands. Integrations that do not make use of ``mlflow server`` or ``mlflow ui`` are unaffected; for example, the Databricks Mana
- Обновитесь до 2.3.1
Опубликовано ОбновленоRelative Path Traversal in mlflow/mlflow
Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.
- Обновитесь до 2.3.1
Опубликовано ОбновленоPath Traversal: '\..\filename' in mlflow/mlflow
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.
- Обновитесь до 2.2.1
Опубликовано ОбновленоAbsolute Path Traversal in mlflow/mlflow
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2.
- Обновитесь до 2.2.1
- Обновитесь до 2.2.2
Опубликовано ОбновленоInsecure Temporary File in mlflow/mlflow
Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.
- Обновитесь до 1.23.1
Опубликовано Обновлено
Проверьте свой сервер
Сопоставьте установленный стек и версии со свежими базами уязвимостей.