CVE-2023-6940: Command Injection
Published Dec 19, 2023
·Updated
with only one user interaction(download a malicious config), attackers can gain full command execution on the victim system.
Affected Software
2 affected componentsFixes available
pip/mlflow<2.9.2
2.9.2
Lfprojects Mlflow<2.9.2
Remediation
Event History
Dec 19, 2023
CVE Published
01:41 AM
Data Sourced
01:41 AM
DescriptionSeverityWeakness
Advisory Published
03:30 AM
Frequently Asked Questions
1
What is the severity of CVE-2023-6940?
CVE-2023-6940 is classified as a critical vulnerability due to its ability to allow full command execution on the victim system with minimal user interaction.
2
How do I fix CVE-2023-6940?
To fix CVE-2023-6940, update the mlflow package to version 2.9.2 or later.
3
What are the risks associated with CVE-2023-6940?
The risks associated with CVE-2023-6940 include unauthorized command execution by attackers, leading to potential system compromise.
4
Who is affected by CVE-2023-6940?
CVE-2023-6940 affects users of the mlflow package versions prior to 2.9.2.
5
How does CVE-2023-6940 exploit the system?
CVE-2023-6940 exploits the system by allowing attackers to execute commands through a malicious configuration file that requires only one user download interaction.