CVE-2025-1474lowCWE-521

CVE-2025-1474: fallo de gravedad baja en mlflow/mlflow

Weak Password Requirements in mlflow/mlflow

Publicada el

Seguir esta CVE+ Monitorear mlflow/mlflow+ Monitorear mlflow

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 3.8epss 0.4%
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Productos afectados
mlflow · mlflow/mlflow
CVEs relacionadas — mlflow/mlflow

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-6909HIGHPath Traversal: '\..\filename' in mlflow/mlflowEPSS 89.7%CVE-2023-1177CRITICALPath Traversal: '\..\filename' in mlflow/mlflowEPSS 69.7%CVE-2023-3765CRITICALAbsolute Path Traversal in mlflow/mlflowEPSS 67.3%CVE-2023-6018CRITICALMLflow Arbitrary File WriteEPSS 47.9%CVE-2024-3848HIGHPath Traversal Bypass in mlflow/mlflowEPSS 43.0%CVE-2024-2928HIGHLocal File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflowEPSS 21.8%