{"id":"CVE-2023-1176","published":"2023-03-24T00:00:00Z","modified":"2025-02-19T20:58:08Z","title":"Absolute Path Traversal in mlflow/mlflow","vendor":"mlflow","product":"mlflow/mlflow","tier":"tail","description":{"text":"Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00583,"percentile":0.47747,"provenance":"source"},"cwes":[{"id":"CWE-36","name":"Absolute Path Traversal"}],"references":[{"url":"https://huntr.dev/bounties/ae92f814-6a08-435c-8445-eec0ef4f1085","tags":[]},{"url":"https://github.com/mlflow/mlflow/commit/63ef72aa4334a6473ce7f889573c92fcae0b3c0d","tags":[]}],"priority":{"score":13.3,"factors":[{"name":"EPSS percentile","points":9.55},{"name":"CVSS severity","points":3.71}]},"vendorSlug":"mlflow","affectedVersions":[{"vendor":"mlflow","product":"mlflow/mlflow","versions":[">= unspecified, < 2.2.2"]}],"affected":[{"ecosystem":"PyPI","package":"mlflow","vulnerableRanges":["<2.2.1","<2.2.2"],"patched":["2.2.1","2.2.2"],"from":["GHSA-wp72-7hj9-5265","PYSEC-2023-28"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-0156","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-0736","published":"2022-02-23","fixed":"1.23.1","kev":false},{"cve":"CVE-2023-30172","published":"2023-05-11","fixed":"2.0.1","kev":false},{"cve":"CVE-2023-1177","published":"2023-03-24","fixed":"2.2.1","kev":false},{"cve":"CVE-2023-1176","published":"2023-03-24","fixed":"2.2.2","kev":false},{"cve":"CVE-2023-2356","published":"2023-04-28","fixed":"2.3.1","kev":false},{"cve":"CVE-2023-2780","published":"2023-05-17","fixed":"2.3.1","kev":false,"link":{"from":"CVE-2023-1176","to":"CVE-2023-2780","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:mlflow","fromFixed":"2.2.2","toFixed":"2.3.0","daysApart":54}]}},{"cve":"CVE-2023-3765","published":"2023-07-19","fixed":"2.5.0","kev":false}],"package":"PyPI:mlflow"}}