CVE-2023-6976
Assigner: @huntr_ai
Published: 2023-12-20T05:30:08.540Z
State: PUBLISHED
title: Unrestricted Upload of File with Dangerous Type
descriptions: value: This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process.
affected: vendor: mlflow
product: mlflow/mlflow
versions: version: unspecified
lessThan: 2.9.2
status: affected
versionType: custom
metrics: cvssV3_0: version: 3.0
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
problemTypes: descriptions: type: CWE
description: CWE-434 Unrestricted Upload of File with Dangerous Type
cweId: CWE-434
source: advisory: 2408a52b-f05b-4cac-9765-4f74bac3f20f
discovery: EXTERNAL