Description
MLflow 是一个机器学习的开源平台。MLflow 开源平台 get-artifact 存在目录遍历漏洞，攻击者可读取系统所有敏感文件。
MLflow get-artifact /ajax-api/2.0/mlflow/experiments/create 目录遍历漏洞 （CVE-2024-1483）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-1483
https://github.com/advisories/GHSA-f82r-jj5r-6g97
https://security.snyk.io/vuln/SNYK-PYTHON-MLFLOW-6615822
https://huntr.com/bounties/52a3855d-93ff-4460-ac24-9c7e4334198d
https://vuldb.com/?id.260864
https://www.miggo.io/vulnerability-database/cve/CVE-2024-1483
https://access.redhat.com/security/cve/cve-2024-1483
https://www.resolvedsecurity.com/vulnerability-catalog/CVE-2024-1483