CVE-2023-6568

描述

A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the user without adequate sanitization or escaping, leading to arbitrary JavaScript execution in the context of the victim's browser. The vulnerability is present in the mlflow/server/auth/__init__.py file, where the user-supplied Content-Type header is directly injected into a Python formatted string and returned to the user, facilitating the XSS attack.

如何修補 CVE-2023-6568

要修補 CVE-2023-6568,請將受影響套件升級到下列已修補版本。

• —升級至 2.9.1 或更新版本
• —升級至 2.9.0 或更新版本
• —升級至 28ff3f94994941e038f2172c6484b65dc4db6ca1 或更新版本

CVE-2023-6568 正在被利用嗎?

低 — EPSS 為 1.6%,目前沒有觀察到大規模利用活動。

受影響套件(3)

• from 0, < 2.9.1
• from 0, < 2.9.0
• from 0, < 28ff3f94994941e038f2172c6484b65dc4db6ca1 | from 0, < 2.9.1

CVSS 分數

參考連結(6)

• ADVISORYgithub.com/advisories/GHSA-vwhf-3v6x-wff8
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-6568
• PATCHgithub.com/mlflow/mlflow
• WEBgithub.com/mlflow/mlflow/commit/28ff3f94994941e038f2172c6484b65dc4db6ca1