Description
In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a limit on the experiment name. This can cause the MLflow UI panel to become unresponsive, leading to a potential denial of service. Additionally, there is no character limit in the `artifact_location` parameter while creating the experiment.
INFO
Published Date :
2025-03-20T10:09:11.431Z
Last Modified :
2025-03-20T14:25:56.917Z
Source :
@huntr_ai
AFFECTED PRODUCTS
The following products are affected by CVE-2024-6838 vulnerability.
| Vendors | Products |
|---|---|
| Lfprojects |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2024-6838.
CVSS Vulnerability Scoring System
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact