CVE-2023-6831

Description

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.

How to fix CVE-2023-6831

To remediate CVE-2023-6831, upgrade the affected package to a fixed version below.

• Bitnami/mlflow—upgrade to 2.9.2 or later
• PyPI/mlflow—upgrade to 2.9.2 or later
• PyPI/mlflow—upgrade to 1da75dfcecd4d169e34809ade55748384e8af6c1 or later

Is CVE-2023-6831 being exploited?

Likely — EPSS is 74.0%, placing CVE-2023-6831 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (3)

• from 0, < 2.9.2
• from 0, < 2.9.2
• from 0, < 1da75dfcecd4d169e34809ade55748384e8af6c1 | from 0, < 2.9.2

CVSS scores

References (6)

• ADVISORYgithub.com/advisories/GHSA-554w-xh4j-8w64
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-6831
• PATCHgithub.com/mlflow/mlflow
• WEBgithub.com/mlflow/mlflow/commit/1da75dfcecd4d169e34809ade55748384e8af6c1