CVE-2024-27134

Advisory

Affected versions of MLflow are vulnerable to Incorrect Default Permissions (CWE-276). During installation, file permissions are set to allow any user to modify installed files, enabling unauthorized users to alter MLflow’s functionality or execute arbitrary code. This vulnerability can be exploited by local attackers with system access to compromise the integrity and security of the MLflow deployment.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-qpgc-w4mg-6v92
• https://github.com/mlflow/mlflow/commit/0b1d995d66a678153e01ed3040f3f4dfc16a0d6b
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27134