Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2025-1474Weak Password Requirements in mlflow/mlflow
Low 3.8
In plain English
A low-severity security flaw in mlflow/mlflow from mlflow. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | mlflow | 2.19.0 | GHSA-4rj2-9gcx-5qhx |
| PyPI | mlflow | 2.19.0 | PYSEC-2025-17 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mlflow | mlflow/mlflow | unspecified – before 2.19.0 |
Weakness: CWE-521 · Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N