CVE-2024-3573
Lfprojects Mlflow vulnerability
- Published15 Apr 2024
Description
mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the 'is_local_uri' function's failure to properly handle URIs with empty or 'file' schemes, leading to the misclassification of URIs as non-local. Attackers can exploit this by crafting malicious model versions with specially crafted 'source' parameters, enabling the reading of sensitive files within at least two directory levels from the server's root.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:NAffected products
Remediation
Frequently asked
Is CVE-2024-3573 being actively exploited?
CVE-2024-3573 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.73%.
How severe is CVE-2024-3573?
CVE-2024-3573 has a CVSS 3.1 base score of 9.3, rated critical. EPSS estimates a 0.73% probability of exploitation.
Which products are affected by CVE-2024-3573?
Affected products include Lfprojects Mlflow.
How do I fix CVE-2024-3573?
Upgrade affected software to a fixed version, for example Lfprojects Mlflow 2.10.0 or later, then confirm no affected versions remain in your inventory.
How Secuno handles this
Secuno correlates vulnerabilities like CVE-2024-3573 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.
Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.