CVE-2023-6015: MLflow allowed arbitrary files to be PUT onto the server

November 16, 2023

MLflow allowed arbitrary files to be PUT onto the server.

References

github.com/advisories/GHSA-f798-qm4r-23r5
github.com/mlflow/mlflow/commit/cf83dad4df26dd4a850622fe8a51ccab1471a5e7
github.com/mlflow/mlflow/pull/10330
huntr.com/bounties/43e6fb72-676e-4670-a225-15d6836f65d3
nvd.nist.gov/vuln/detail/CVE-2023-6015

Code Behaviors & Features

Detect and mitigate CVE-2023-6015 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →