Опубликовано: 25 нояб. 2024
Источник: github
Github: Прошло ревью
CVSS4: 7.3
CVSS3: 7
Описание
MLflow's excessive directory permissions allow local privilege escalation
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.
Пакеты
Наименование
mlflow
pip
Затронутые версииВерсия исправления
< 2.16.0
2.16.0
Связанные уязвимости
CVSS3: 7
nvd
около 1 года назад
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.