Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-cjtm-4k48-vybn
Summary
Path Traversal: '\..\filename'
This vulnerability enables malicious users to read sensitive files on the server.
Aliases
0
alias CVE-2023-6977
1
alias GHSA-qg8p-32gr-gh6x
Fixed_packages
0
url pkg:pypi/mlflow@2.9.2
purl pkg:pypi/mlflow@2.9.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5qe9-6ecs-syek
1
vulnerability VCID-6tvx-kzfy-xfhv
2
vulnerability VCID-6x4v-udkg-z3es
3
vulnerability VCID-76zk-ent1-myc9
4
vulnerability VCID-8kf8-a6w5-m3b5
5
vulnerability VCID-96st-1wwr-4ken
6
vulnerability VCID-gr3d-61ds-j7ej
7
vulnerability VCID-njg8-d2r5-rfax
8
vulnerability VCID-pugd-v7em-sbec
9
vulnerability VCID-qnyj-3qc7-p7bp
10
vulnerability VCID-r2kq-hqdf-6ugh
11
vulnerability VCID-r9df-3b7p-jfcy
12
vulnerability VCID-s2ry-vd94-qfc6
13
vulnerability VCID-utmm-2j11-eyh6
14
vulnerability VCID-xge2-eqq3-7bb9
15
vulnerability VCID-ya6d-ny22-ybdh
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mlflow@2.9.2
Affected_packages
References
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-6977
reference_id
reference_type
scores
0
value 0.83041
scoring_system epss
scoring_elements 0.99274
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-6977
1
reference_url https://github.com/mlflow/mlflow/commit/4bd7f27c810ba7487d53ed5ef1038fca0f8dc28c
reference_id
reference_type
scores
url https://github.com/mlflow/mlflow/commit/4bd7f27c810ba7487d53ed5ef1038fca0f8dc28c
2
reference_url https://huntr.com/bounties/fe53bf71-3687-4711-90df-c26172880aaf
reference_id
reference_type
scores
url https://huntr.com/bounties/fe53bf71-3687-4711-90df-c26172880aaf
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-6977
reference_id CVE-2023-6977
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-6977
4
reference_url https://github.com/advisories/GHSA-qg8p-32gr-gh6x
reference_id GHSA-qg8p-32gr-gh6x
reference_type
scores
url https://github.com/advisories/GHSA-qg8p-32gr-gh6x
Weaknesses
0
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
1
cwe_id 29
name Path Traversal: '..filename'
description The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '..filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.
2
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
Exploits
Severity_range_scorenull
Exploitabilitynull
Weighted_severitynull
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-cjtm-4k48-vybn