MLflow Server-Side Request Forgery (SSRF)

严重 9.8CVE-2023-6974 · BIT-mlflow-2023-6974 · GHSA-59v3-898r-qwhj · Published 20/12/2023 · updated 17/06/2026

要点

CVE-2023-6974 是影响 mlflow, mlflow (lfprojects) 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：1.5%，高于 74.6% 的漏洞。
修复：升级到 2.9.2 或更高版本。

Package	Affected versions	Patched versions
mlflow PyPI	`< 2.9.2`	`2.9.2`
mlflow lfprojects	`< 2.9.2`	`2.9.2`

Description

A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abused to get a remote code execution on the victim machine.

NVD description

A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abuse to get a remote code execution on the victim machine.

References

nvd.nist.gov/vuln/detail/CVE-2023-6974 · ADVISORY
mlflow/mlflow commit 8174250 · WEB
mlflow/mlflow · WEB
huntr.com/bounties/438b0524-da0e-4d08-976a-6f270c688393 · WEB
pypi.org/project/mlflow · PACKAGE
GitHub Advisory GHSA-59v3-898r-qwhj · ADVISORY

mlflow 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mlflow

PyPI

< 2.9.2

2.9.2

mlflow

lfprojects

< 2.9.2

2.9.2

Description

A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abused to get a remote code execution on the victim machine.

NVD description

A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abuse to get a remote code execution on the victim machine.

mlflow 的其他漏洞

查看全部 →