CVE-2024-27134highCWE-276CWE-367

CVE-2024-27134: falha de alta gravidade em mlflow

Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf

Publicada em

Seguir esta CVE+ Monitorar MLflow+ Monitorar mlflow

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7epss 0.1%
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
mlflow
CVEs relacionadas — mlflow

No mesmo produto, das mais perigosas para as menos.

CVE-2024-27132HIGHInsufficient sanitization in MLflow leads to XSS when running an untrusted recipe.EPSS 0.9%CVE-2024-27133HIGHInsufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset.EPSS 0.7%