← All advisories

High severity7.5NVD Advisory· Published Dec 5, 2023· Updated Jun 17, 2026

CVE-2023-43472

CVE-2023-43472

Description

An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
mlflowPyPI	< 2.9.0	2.9.0

Affected products

4

ghsa-coords2 versions
pkg:pypi/mlflow pkg:bitnami/mlflow
< 2.9.0+ 1 more
- (no CPE)range: < 2.9.0
- (no CPE)range: < 2.8.2
Mlflow/Mlflow2 versions
cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*range: <=2.8.1
- (no CPE)

Patches

Vulnerability mechanics

References

4

www.contrastsecurity.com/security-influencers/discovering-mlflow-framework-zero-day-vulnerability-machine-language-model-security-contrast-securitynvdExploitPress/Media CoverageWEB
github.com/advisories/GHSA-wqxf-447m-6f5fghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-43472ghsaADVISORY
mlflow.org/news/2023/12/06/2.9.0-release/index.htmlghsaWEB

News mentions

0

No linked articles in our index yet.