Safety vulnerability ID: 71582
The information on this page was manually curated by our Cybersecurity Intelligence Team.
Affected versions of Mlflow allow attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service (DoS) as an authenticated user might not be able to use the intended model, as it will open a different model each time. Additionally, an attacker can exploit this vulnerability to perform data model poisoning by creating a model with the same name, potentially causing an authenticated user to become a victim by using the poisoned model. The issue stems from inadequate validation of model names, allowing for the creation of models with URL-encoded names that are treated as distinct from their URL-decoded counterparts.
Latest version: 2.19.0
MLflow is an open source platform for the complete machine learning lifecycle
This vulnerability has no description
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application