UpHeron
All vulnerabilities

Servers and applications

CVE-2024-2928

A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local…

Severity
High 7.5
Published
6 Jun 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.11.3
Sources
NVD

Affected software

SoftwareAffected versions
MLflowServers and applications · cpe:a:lfprojects:mlflow
  • Every version before 2.11.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-2928
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-2928