Description
MLflow 是一个机器学习的开源平台。MLflow 开源平台 get-artifact 存在目录遍历漏洞，攻击者可读取系统所有敏感文件。
MLflow get-artifact 目录遍历漏洞（CVE-2024-2928）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-2928
https://github.com/advisories/GHSA-j46q-5pxx-8vmw
https://www.offsec.com/blog/cve-2024-2928/
https://security.snyk.io/vuln/SNYK-PYTHON-MLFLOW-7217833
https://huntr.com/bounties/19bf02d7-6393-4a95-b9d0-d6d4d2d8c298
https://pentest-tools.com/vulnerabilities-exploits/mlflow-2113-path-traversal_25815
https://access.redhat.com/security/cve/cve-2024-2928