Vulnerability · Published May 16, 2024 · Assigned by @huntr_ai
CVE-2024-4263Improper Access Control in mlflow/mlflow
Medium 5.4
In plain English
A medium-severity improper access control in mlflow/mlflow from mlflow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low privilege users with only EDIT permissions on an experiment can delete any artifacts. This issue arises due to the lack of proper validation for DELETE requests by users with EDIT permissions, allowing them to perform unauthorized deletions of artifacts. The vulnerability specifically affects the handling of artifact deletions within the application, as demonstrated by the ability of a low privilege user to delete a directory inside an artifact using a DELETE request, despite the official documentation stating that users with EDIT permission can only read and update artifacts, not delete them.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | mlflow | 2.10.1 | GHSA-p4jx-q62p-x5jr |
| PyPI | mlflow | 2.10.1 | PYSEC-2024-51 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mlflow | mlflow/mlflow | unspecified – before 2.10.1 |
Weakness: CWE-284 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L