CVE-2023-3765

Description

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.

How to fix CVE-2023-3765

To remediate CVE-2023-3765, upgrade the affected package to a fixed version below.

• Bitnami/mlflow—upgrade to 2.5.0 or later
• PyPI/mlflow—upgrade to 2.5.0 or later
• PyPI/mlflow—upgrade to 6dde93758d42455cb90ef324407919ed67668b9b or later

Is CVE-2023-3765 being exploited?

Likely — EPSS is 91.5%, placing CVE-2023-3765 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (3)

• from 0, < 2.5.0
• from 0, < 2.5.0
• from 0, < 6dde93758d42455cb90ef324407919ed67668b9b, < 6dde93758d42455cb90ef324407919ed67668b9b | from 0, < 2.5.0

CVSS scores

References (6)

• ADVISORYgithub.com/advisories/GHSA-fmxj-6h9g-6vw3
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-3765
• PATCHgithub.com/mlflow/mlflow
• WEBgithub.com/mlflow/mlflow/commit/6dde93758d42455cb90ef324407919ed67668b9b