- CVSS
- CRITICAL · 9.8 v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Published
- 2023-11-16
- Weakness
- CWE-78
- Source
- nvd.nist.gov/vuln/detail/CVE-2023-6018
Description
An attacker can overwrite any file on the server hosting MLflow without any authentication.
References
How GTK Cyber trains on this
AI security training at GTK Cyber covers the LLM and ML-pipeline vulnerability classes that vulnerabilities like CVE-2023-6018 fall into. Our hands-on courses are taught by Charles Givre and other practitioners who break and defend production AI systems.