2 lines
3.1 KiB
JSON
2 lines
3.1 KiB
JSON
{"affected":[{"affectedData":[{"product":"mlflow/mlflow","vendor":"mlflow","versions":[{"lessThanOrEqual":"latest","status":"affected","version":"unspecified","versionType":"custom"}]}],"source":"security@huntr.dev"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:lfprojects:mlflow:3.9.0:-:*:*:*:*:*:*","matchCriteriaId":"454B4D36-BE89-42E7-A901-19B4DD7F4AC5","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' endpoints. Specifically, the `BEFORE_REQUEST_HANDLERS` dictionary in `mlflow/server/auth/__init__.py` does not include entries for `ListGatewaySecretInfos`, `ListGatewayEndpoints`, and `ListGatewayModelDefinitions`. This allows any authenticated user, regardless of their assigned permissions, to enumerate all gateway secrets, endpoints, and model definitions. This vulnerability exposes sensitive information, such as API keys, endpoint configurations, and proprietary model definitions, to unauthorized users."},{"lang":"es","value":"MLflow 3.9.0 con autenticación básica ('--app-name basic-auth') no aplica las comprobaciones de autorización para múltiples puntos finales list de la API de Gateway. Específicamente, el diccionario 'BEFORE_REQUEST_HANDLERS' en 'mlflow/server/auth/__init__.py' no incluye entradas para 'ListGatewaySecretInfos', 'ListGatewayEndpoints' y 'ListGatewayModelDefinitions'. Esto permite a cualquier usuario autenticado, independientemente de sus permisos asignados, enumerar todos los secretos, puntos finales y definiciones de modelos de la pasarela. Esta vulnerabilidad expone información sensible, como claves de API, configuraciones de puntos finales y definiciones de modelos propietarios, a usuarios no autorizados."}],"id":"CVE-2026-3198","lastModified":"2026-07-21T19:10:00.107","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.0"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security@huntr.dev","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3198","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-06-02T13:32:18.258552Z","version":"2.0.3"}}]},"published":"2026-06-02T04:17:03.397","references":[{"source":"security@huntr.dev","tags":["Exploit","Third Party Advisory"],"url":"https://huntr.com/bounties/e57db731-97d3-40c3-a429-831ee959807f"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"],"url":"https://huntr.com/bounties/e57db731-97d3-40c3-a429-831ee959807f"}],"sourceIdentifier":"security@huntr.dev","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"security@huntr.dev","type":"Secondary"}]}
|