7.0
Élevée
CVE-2024-27134 Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf
Description
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| MLflow 2.16 | premières → < 2.16.0 | 2.16.0 |
Autres CVE de MLflow
Les 20 CVE de MLflow →
CVE-2025-52967
gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation
5.8
Moyenne
CVE-2024-2928
A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was…
7.5
Élevée
CVE-2024-3099
A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by…
5.4
Moyenne
CVE-2024-37061
Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a…
8.8
Élevée