CVE-2023-6014
Assigner: @huntr_ai
Published: 2023-11-16T21:07:36.577Z
State: PUBLISHED
title: MLflow Authentication Bypass
descriptions: value: An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.
affected: vendor: mlflow
product: mlflow/mlflow
versions: version: unspecified
status: affected
versionType: custom
lessThanOrEqual: latest
metrics: cvssV3_0: version: 3.0
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
baseScore: 9.1
baseSeverity: CRITICAL
problemTypes: descriptions: type: CWE
description: CWE-598 Use of GET Request Method With Sensitive Query Strings
cweId: CWE-598
source: advisory: 3e64df69-ddc2-463e-9809-d07c24dc1de4
discovery: EXTERNAL