Miggo Logo
Miggo Vulnerability Database
→
CVE-2025-1473

CVE-2025-1473: MLflow Cross-Site Request Forgery (CSRF) vulnerability

5.4

CVSS Score
3.0

Basic Information

CVE ID
CVE-2025-1473
GHSA ID
GHSA-969w-gqqr-g6j3
EPSS Score
0.05591%
CWE
CWE-352
Published
3/20/2025
Updated
3/21/2025
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
mlflowpip

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from insufficient CSRF protection in MLflow's signup feature. The commit diff shows environment variable documentation changes (MLFLOW_FLASK_SERVER_SECRET_KEY) related to CSRF protection. Flask applications require a secret key for CSRF token validation. If this key wasn't properly enforced in the signup handler, attackers could forge requests to create accounts. While the exact route implementation isn't visible in the diff, the environmental variable context and CWE-352 classification strongly indicate the signup endpoint was vulnerable due to missing CSRF token validation when the secret key wasn't set.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* *ross-Sit* R*qu*st *or**ry (*SR*) vuln*r**ility *xists in t** Si*nup ***tur* o* ml*low/ml*low v*rsions *.**.* to *.**.*. T*is vuln*r**ility *llows *n *tt**k*r to *r**t* * n*w ***ount, w*i** m*y ** us** to p*r*orm un*ut*oriz** **tions on ****l* o* t

Reasoning

T** vuln*r**ility st*ms *rom insu**i*i*nt *SR* prot**tion in ML*low's si*nup ***tur*. T** *ommit *i** s*ows *nvironm*nt v*ri**l* *o*um*nt*tion ***n**s (ML*LOW_*L*SK_S*RV*R_S**R*T_K*Y) r*l*t** to *SR* prot**tion. *l*sk *ppli**tions r*quir* * s**r*t k*