Skip to content
OpenAdvisories
High · 7.0 CVE-2024-27134 BIT-mlflow-2024-27134EUVD-2024-0115GHSA-qpgc-w4mg-6v92PYSEC-2024-224

Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf

Published Nov 25, 2024 · Updated Nov 25, 2024 · Assigned by JFROG

Description

Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.

Affected products

VendorProductAffectedFixed
— mlflow < 2.16.0 2.16.0

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI mlflow < 2.16.0 2.16.0 GHSA-qpgc-w4mg-6v92

References