CVE-2023-6568: Reflected XSS via Content-Type Header in mlflow/mlflow
First published: Thu Dec 07 2023(Updated: )
A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the user without adequate sanitization or escaping, leading to arbitrary JavaScript execution in the context of the victim's browser. The vulnerability is present in the mlflow/server/auth/__init__.py file, where the user-supplied Content-Type header is directly injected into a Python formatted string and returned to the user, facilitating the XSS attack.
Credit: security@huntr.dev security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/mlflow | <2.9.0 | 2.9.0 |
| Lfprojects Mlflow | <=2.9.0 | |
| <=2.9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/mlflow/mlflow/commit/28ff3f94994941e038f2172c6484b65dc4db6ca1
- https://huntr.com/bounties/816bdaaa-8153-4732-951e-b0d92fddf709
- https://nvd.nist.gov/vuln/detail/CVE-2023-6568
- https://github.com/advisories/GHSA-vwhf-3v6x-wff8 (Advisory)
- https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2023-260.yaml
Frequently Asked Questions
What is the vulnerability CVE-2023-6568?
CVE-2023-6568 is a Cross-site Scripting (XSS) vulnerability that exists in the mlflow GitHub repository prior to version 2.9.0.
How does the Cross-site Scripting (XSS) vulnerability CVE-2023-6568 affect mlflow?
The Cross-site Scripting (XSS) vulnerability CVE-2023-6568 affects the mlflow GitHub repository prior to version 2.9.0.
What is the severity of vulnerability CVE-2023-6568?
The severity of vulnerability CVE-2023-6568 is medium with a CVSS score of 6.5.
What is the Common Weakness Enumeration (CWE) ID for vulnerability CVE-2023-6568?
The Common Weakness Enumeration (CWE) ID for vulnerability CVE-2023-6568 is CWE-79.
How can I fix the Cross-site Scripting (XSS) vulnerability CVE-2023-6568 in mlflow?
To fix the Cross-site Scripting (XSS) vulnerability CVE-2023-6568 in mlflow, update the GitHub repository to version 2.9.0 or newer.
- agent/author
- agent/type
- agent/first-publish-date
- agent/remedy
- agent/weakness
- agent/severity
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/title
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-vwhf-3v6x-wff8
- alias/CVE-2023-6568
- agent/references
- collector/nvd-api
- agent/softwarecombine
- agent/event
- collector/github-advisory
- agent/tags
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- vendor/lfprojects
- canonical/lfprojects mlflow
- version/lfprojects mlflow/2.9.0
- package-manager/pip