CVE-2024-37061: Code Injection
Published Jun 4, 2024
·Updated
Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run due to unfiltered input.
Affected Software
2 affected components
pip/mlflow>=1.11.0<=2.13.1
Lfprojects Mlflow>=1.11.0
Event History
Jun 4, 2024
CVE Published
via MITRE·12:02 PM
Data Sourced
via MITRE·12:02 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:15 PM
Affected Software
Advisory Published
via GitHub·12:31 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-37061?
CVE-2024-37061 is classified as a critical vulnerability because it allows remote code execution on affected systems.
2
How do I fix CVE-2024-37061?
To mitigate CVE-2024-37061, upgrade your MLflow installation to a version newer than 2.13.1.
3
Which versions of MLflow are affected by CVE-2024-37061?
CVE-2024-37061 affects MLflow versions from 1.11.0 to 2.13.1 inclusive.
4
What impact does CVE-2024-37061 have on my system?
Exploitation of CVE-2024-37061 can lead to arbitrary code execution, potentially compromising your system's integrity and security.
5
Is CVE-2024-37061 related to unfiltered input?
Yes, CVE-2024-37061 is caused by unfiltered input in MLproject files that can allow malicious code execution.