A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like '/etc/passwd'. The vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI's query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/19bf02d7-6393-4a95-b9d0-d6d4d2d8c298 | Exploit Issue Tracking Patch Third Party Advisory |
| https://github.com/mlflow/mlflow/commit/96f0b573a73d8eedd6735a2ce26e08859527be07 | Patch |
Configurations
History
11 Oct 2024, 15:28
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Lfprojects mlflow
Lfprojects |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CPE | cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:* | |
| CWE | CWE-22 | |
| References | () https://github.com/mlflow/mlflow/commit/96f0b573a73d8eedd6735a2ce26e08859527be07 - Patch | |
| References | () https://huntr.com/bounties/19bf02d7-6393-4a95-b9d0-d6d4d2d8c298 - Exploit, Issue Tracking, Patch, Third Party Advisory |
06 Jun 2024, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-06-06 19:15
Updated : 2024-10-11 15:28
NVD link : CVE-2024-2928
Mitre link : CVE-2024-2928
JSON object : View
Products Affected
lfprojects
- mlflow
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')