Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MLflow Use of Default Password Authentication Bypass Vulnerability
Vulnerability Description
MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the basic_auth.ini file. The file contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the administrator. Was ZDI-CAN-28256.
CVSS Information
N/A
Vulnerability Type
CWE-1393
Vulnerability Title
MLflow 安全漏洞
Vulnerability Description
MLflow是MLflow开源的一个简化机器学习开发的平台，包括跟踪实验、将代码打包成可重复的运行以及共享和部署模型。 MLflow存在安全漏洞，该漏洞源于使用硬编码默认凭据，可能导致身份验证绕过和任意代码执行。
CVSS Information
N/A
Vulnerability Type
N/A