{"id":"CVE-2024-2928","published":"2024-06-06T18:29:54Z","modified":"2024-08-01T19:32:42Z","title":"Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow","vendor":"mlflow","product":"mlflow/mlflow","tier":"tail","description":{"text":"A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like '/etc/passwd'. The vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI's query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.21847,"percentile":0.97641,"provenance":"source"},"cwes":[{"id":"CWE-29","name":"Path Traversal: '..filename'"}],"references":[{"url":"https://huntr.com/bounties/19bf02d7-6393-4a95-b9d0-d6d4d2d8c298","tags":[]},{"url":"https://github.com/mlflow/mlflow/commit/96f0b573a73d8eedd6735a2ce26e08859527be07","tags":[]}],"priority":{"score":29.8,"factors":[{"name":"EPSS percentile","points":19.53},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":5.25}]},"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2024-11-08","earliestUrl":"https://github.com/nuridincersaygili/CVE-2024-2928","repos":[{"name":"nuridincersaygili/CVE-2024-2928","url":"https://github.com/nuridincersaygili/CVE-2024-2928","stars":3,"created":"2024-11-08"},{"name":"rain321654/sjtu_CVE-2024-2928","url":"https://github.com/rain321654/sjtu_CVE-2024-2928","stars":1,"created":"2025-12-04"}]},"nuclei":[{"id":"CVE-2024-2928","name":"MLflow < 2.11.3 - Path Traversal","severity":"high","path":"http/cves/2024/CVE-2024-2928.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2928.yaml"}],"first":{"date":"2024-11-08","source":"PoC-in-GitHub","url":"https://github.com/nuridincersaygili/CVE-2024-2928"},"provenance":"source"},"vendorSlug":"mlflow","affectedVersions":[{"vendor":"mlflow","product":"mlflow/mlflow","versions":[">= unspecified, < 2.11.3"]}],"affected":[{"ecosystem":"PyPI","package":"mlflow","vulnerableRanges":["<2.11.3"],"patched":["2.11.3"],"from":["GHSA-j46q-5pxx-8vmw","PYSEC-2024-242"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2083","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-mlflow-mlflow-cve-2023-2780","parents":[{"from":"CVE-2024-3573","to":"CVE-2024-2928","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["mlflow/server/handlers.py"],"commits":["https://github.com/mlflow/mlflow/commit/96f0b573a73d8eedd6735a2ce26e08859527be07","https://github.com/mlflow/mlflow/commit/438a450714a3ca06285eeea34bdc6cf79d7f6cbc"],"basis":"shared function","functions":["_validate_source"]}]}],"packageHistory":[{"cve":"CVE-2024-27133","published":"2024-02-23","fixed":"2.10.0","kev":false},{"cve":"CVE-2024-3573","published":"2024-04-16","fixed":"2.10.0","kev":false},{"cve":"CVE-2024-4263","published":"2024-05-16","fixed":"2.10.1","kev":false,"link":{"from":"CVE-2024-4263","to":"CVE-2024-2928","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:mlflow","fromFixed":"2.10.1","toFixed":"2.11.3","daysApart":21}]}},{"cve":"CVE-2024-2928","published":"2024-06-06","fixed":"2.11.3","kev":false},{"cve":"CVE-2024-3099","published":"2024-06-06","fixed":"2.11.3","kev":false},{"cve":"CVE-2024-1483","published":"2024-04-16","fixed":"2.12.1","kev":false},{"cve":"CVE-2024-1558","published":"2024-04-16","fixed":"2.12.1","kev":false}],"package":"PyPI:mlflow"}}