Detections
Analytics

SCA: security update for mlflow (GHSA-p4jx-q62p-x5jr)

medium Tenable Cloud Security Plugin ID 417273

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low privilege
 users with only EDIT permissions on an experiment can delete any artifacts. This issue arises due to the
 lack of proper validation for DELETE requests by users with EDIT permissions, allowing them to perform
 unauthorized deletions of artifacts. The vulnerability specifically affects the handling of artifact
 deletions within the application, as demonstrated by the ability of a low privilege user to delete a
 directory inside an artifact using a DELETE request, despite the official documentation stating that users
 with EDIT permission can only read and update artifacts, not delete them. (CVE-2024-4263)

See Also

https://github.com/advisories/GHSA-p4jx-q62p-x5jr

Plugin Details

Severity: Medium

ID: 417273

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.1

Percentile: 7.69

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:P

CVSS Score Source: CVE-2024-4263

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/16/2024

Vulnerability Publication Date: 5/16/2024

Reference Information

CVE: CVE-2024-4263

cwe: CWE-284