CVE-2023-6014
MLflow Authentication Bypass
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
MLflow Authentication Bypass
| Assigner | @huntr_ai |
| Reserved | 2023-11-08 |
| Published | 2023-11-16 |
| Updated | 2024-09-04 |
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.
| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
CWE-598 Use of GET Request Method With Sensitive Query Strings
https://huntr.com/bounties/3e64df69-ddc2-463e-9809-d07c24dc1de4
