CVE-2023-6018

Description

An attacker can overwrite any file on the server hosting MLflow without any authentication.

How to fix CVE-2023-6018

To remediate CVE-2023-6018, upgrade the affected package to a fixed version below.

• PyPI/mlflow—upgrade to 2.9.2 or later

Is CVE-2023-6018 being exploited?

Moderate — EPSS is 47.9%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (1)

• from 0, < 2.9.2

CVSS scores

References (6)

• ADVISORYgithub.com/advisories/GHSA-5p3h-7fwh-92rc
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-6018
• PATCHgithub.com/mlflow/mlflow
• PATCHpypi.org/project/mlflow
• WEBgithub.com