- CVSS
- HIGH · 8.8 v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Published
- 2024-06-04
- Weakness
- CWE-502, CWE-502
- Source
- nvd.nist.gov/vuln/detail/CVE-2024-37056
Description
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user’s system when interacted with.
References
How GTK Cyber trains on this
AI security training at GTK Cyber covers the LLM and ML-pipeline vulnerability classes that vulnerabilities like CVE-2024-37056 fall into. Our hands-on courses are taught by Charles Givre and other practitioners who break and defend production AI systems.