Description
MLflow 是一个机器学习的开源平台。MLflow 开源平台 get-artifact 存在目录遍历漏洞，攻击者可读取系统所有敏感文件。
MLflow get-artifact /ajax-api/2.0/mlflow/experiments/create 目录遍历漏洞 （CVE-2024-3848）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-3848
https://github.com/advisories/GHSA-rfqq-wq6w-72jm
https://security.snyk.io/vuln/SNYK-PYTHON-MLFLOW-6860431
https://huntr.com/bounties/8d5aadaa-522f-4839-b41b-d7da362dd610
https://access.redhat.com/security/cve/CVE-2024-3848