CVE-2024-4263: Improper Access Control in mlflow/mlflow
First published: Thu May 16 2024(Updated: )
A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low privilege users with only EDIT permissions on an experiment can delete any artifacts. This issue arises due to the lack of proper validation for DELETE requests by users with EDIT permissions, allowing them to perform unauthorized deletions of artifacts. The vulnerability specifically affects the handling of artifact deletions within the application, as demonstrated by the ability of a low privilege user to delete a directory inside an artifact using a DELETE request, despite the official documentation stating that users with EDIT permission can only read and update artifacts, not delete them.
Credit: security@huntr.dev security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/mlflow | <2.10.1 | 2.10.1 |
| MLflow | <2.12.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://huntr.com/bounties/bfa116d3-2af8-4c4a-ac34-ccde7491ae11
- https://github.com/mlflow/mlflow/commit/b43e0e3de5b500554e13dc032ba2083b2d6c94b8
- https://nvd.nist.gov/vuln/detail/CVE-2024-4263
- https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2024-51.yaml
- https://github.com/advisories/GHSA-p4jx-q62p-x5jr (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-4263?
CVE-2024-4263 is classified as a moderate severity vulnerability due to broken access control allowing low privilege users to delete artifacts.
How do I fix CVE-2024-4263?
To fix CVE-2024-4263, upgrade to mlflow version 2.10.1 or later.
What versions are affected by CVE-2024-4263?
CVE-2024-4263 affects mlflow versions prior to 2.10.1.
What type of vulnerability is CVE-2024-4263?
CVE-2024-4263 is a broken access control vulnerability that allows unauthorized deletion of artifacts.
Who can exploit CVE-2024-4263?
Low privilege users with EDIT permissions on an experiment can exploit CVE-2024-4263 to delete any artifacts.
- agent/title
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-p4jx-q62p-x5jr
- alias/CVE-2024-4263
- agent/software-canonical-lookup
- agent/references
- collector/nvd-cve
- source/NVD
- agent/author
- collector/github-advisory
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/source
- collector/nvd-api
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- agent/tags
- package-manager/pip
- vendor/lfprojects
- canonical/mlflow