MLflow allowed arbitrary files to be PUT onto the server

🔗 CVE IDs covered (1)

📋 Description

🎯 Affected products1

• pip/mlflow:< 2.8.1

🔗 References (5)

• https://nvd.nist.gov/vuln/detail/CVE-2023-6015
• https://huntr.com/bounties/43e6fb72-676e-4670-a225-15d6836f65d3
• https://github.com/mlflow/mlflow/pull/10330
• https://github.com/mlflow/mlflow/commit/cf83dad4df26dd4a850622fe8a51ccab1471a5e7
• https://github.com/advisories/GHSA-f798-qm4r-23r5