CVE-2024-37060: MLFlow unsafe deserialization
8.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.52046%
CWE
Published
6/4/2024
Updated
6/21/2024
KEV Status
No
Technology
Python
PythonTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mlflow | pip | >= 1.27.0, <= 2.14.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability CVE-2024-37060 specifically references unsafe deserialization in the BaseCard.load method within recipes/cards/init.py. The code snippet shows direct use of pickle.load() on user-controlled file paths, with no validation or safe deserialization mechanisms. This matches the CWE-502 pattern and the advisory's description of Recipe-based exploitation. Other CVEs in the advisory relate to different components (sklearn, pyfunc, etc.), but this entry specifically implicates the BaseCard.load method as the vulnerable entry point for this particular CVE.