CVE-2023-6974: Server-Side Request Forgery (SSRF)

December 20, 2023

A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abuse to get a remote code execution on the victim machine.

References

github.com/advisories/GHSA-59v3-898r-qwhj
github.com/mlflow/mlflow/commit/8174250f83352a04c2d42079f414759060458555
huntr.com/bounties/438b0524-da0e-4d08-976a-6f270c688393
nvd.nist.gov/vuln/detail/CVE-2023-6974

Code Behaviors & Features

Detect and mitigate CVE-2023-6974 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →