CVE-2025-1474

Katalog CVE

CVSS 5.5 · Medium EPSS 0,37%

Kerentanan Weak Password Requirements pada lfprojects mlflow. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.

Rincian

Terbit di NVD

20 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-521: Weak Password Requirements

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mlflow/mlflow/commit/149c9e18aa219bc47e86b432e130e467a36f4a17 patch
• https://huntr.com/bounties/e79f7774-10fe-46b2-b522-e73b748e3b2d exploit · advisory pihak ketiga