Use of GET Request Method With Sensitive Query Strings
CVE-2023-6014
Summary
An attacker is able to arbitrarily create an account in MLflow in versions 2.4.0 through 2.7.1 bypassing any authentication requirement.
- LOW
- NETWORK
- HIGH
- UNCHANGED
- NONE
- NONE
- HIGH
- HIGH
CWE-598 - Use of GET Request Method With Sensitive Query Strings
The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.
References
Advisory Timeline
- Published
