CVE-2023-6568

Advisory

mlflow 2.9.2 addresses a vulnerability that allows an attacker to inject malicious code into the “Content-Type” header of a POST request, which is then reflected back to the user without proper sanitization or escaping.
https://github.com/mlflow/mlflow/commit/28ff3f94994941e038f2172c6484b65dc4db6ca1

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6568
• https://huntr.com/bounties/816bdaaa-8153-4732-951e-b0d92fddf709/
• https://huntr.com/bounties/816bdaaa-8153-4732-951e-b0d92fddf709
• https://github.com/mlflow/mlflow/commit/28ff3f94994941e038f2172c6484b65dc4db6ca1