Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-9ytn-66pw-kkc3
Summary
MLflow authentication requirement bypass can allow a user to arbitrarily create an account
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.
Aliases
0
alias CVE-2023-6014
1
alias GHSA-4qq5-mxxx-m6gg
Fixed_packages
0
url pkg:pypi/mlflow@2.8.0
purl pkg:pypi/mlflow@2.8.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-36at-75qp-sqay
1
vulnerability VCID-48xy-zsv8-8ube
2
vulnerability VCID-5qe9-6ecs-syek
3
vulnerability VCID-6x4v-udkg-z3es
4
vulnerability VCID-96st-1wwr-4ken
5
vulnerability VCID-a9rm-cwyd-u3eh
6
vulnerability VCID-gr3d-61ds-j7ej
7
vulnerability VCID-njg8-d2r5-rfax
8
vulnerability VCID-pugd-v7em-sbec
9
vulnerability VCID-qb49-yrtm-mfhm
10
vulnerability VCID-qnyj-3qc7-p7bp
11
vulnerability VCID-r2kq-hqdf-6ugh
12
vulnerability VCID-r9df-3b7p-jfcy
13
vulnerability VCID-rcw6-b3d2-8kgw
14
vulnerability VCID-utmm-2j11-eyh6
15
vulnerability VCID-xge2-eqq3-7bb9
16
vulnerability VCID-xk3w-k96c-3kav
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mlflow@2.8.0
Affected_packages
0
url pkg:pypi/mlflow@2.5.0
purl pkg:pypi/mlflow@2.5.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-36at-75qp-sqay
1
vulnerability VCID-48xy-zsv8-8ube
2
vulnerability VCID-5qe9-6ecs-syek
3
vulnerability VCID-6x4v-udkg-z3es
4
vulnerability VCID-96st-1wwr-4ken
5
vulnerability VCID-9ytn-66pw-kkc3
6
vulnerability VCID-a9rm-cwyd-u3eh
7
vulnerability VCID-gr3d-61ds-j7ej
8
vulnerability VCID-k4t6-vtwa-zyad
9
vulnerability VCID-maaz-3ur8-s3eg
10
vulnerability VCID-njg8-d2r5-rfax
11
vulnerability VCID-pugd-v7em-sbec
12
vulnerability VCID-qb49-yrtm-mfhm
13
vulnerability VCID-qnyj-3qc7-p7bp
14
vulnerability VCID-r2kq-hqdf-6ugh
15
vulnerability VCID-r9df-3b7p-jfcy
16
vulnerability VCID-rcw6-b3d2-8kgw
17
vulnerability VCID-utmm-2j11-eyh6
18
vulnerability VCID-xge2-eqq3-7bb9
19
vulnerability VCID-xk3w-k96c-3kav
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mlflow@2.5.0
References
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-6014
reference_id
reference_type
scores
0
value 0.00875
scoring_system epss
scoring_elements 0.756
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-6014
1
reference_url https://github.com/mlflow/mlflow
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/mlflow/mlflow
2
reference_url https://github.com/mlflow/mlflow/commit/32de2154ef9f946160e5dc01a4d8a449dd0bd259
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/mlflow/mlflow/commit/32de2154ef9f946160e5dc01a4d8a449dd0bd259
3
reference_url https://github.com/mlflow/mlflow/issues/9669
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/mlflow/mlflow/issues/9669
4
reference_url https://github.com/mlflow/mlflow/pull/9700
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/mlflow/mlflow/pull/9700
5
reference_url https://github.com/mlflow/mlflow/releases/tag/v2.8.0
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/mlflow/mlflow/releases/tag/v2.8.0
6
reference_url https://huntr.com/bounties/3e64df69-ddc2-463e-9809-d07c24dc1de4
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2024-09-04T20:20:13Z/
url https://huntr.com/bounties/3e64df69-ddc2-463e-9809-d07c24dc1de4
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-6014
reference_id CVE-2023-6014
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-6014
8
reference_url https://github.com/advisories/GHSA-4qq5-mxxx-m6gg
reference_id GHSA-4qq5-mxxx-m6gg
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-4qq5-mxxx-m6gg
Weaknesses
0
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
1
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
2
cwe_id 598
name Use of GET Request Method With Sensitive Query Strings
description The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.
Exploits
Severity_range_score9.0 - 10.0
Exploitability0.5
Weighted_severity0.0
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-9ytn-66pw-kkc3