mlflow up to 2.18.x weak password

Summaryinfo

A vulnerability marked as critical has been reported in mlflow up to 2.18.x. Impacted is an unknown function. The manipulation leads to weak password. This vulnerability is uniquely identified as CVE-2025-1474. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in mlflow up to 2.18.x. It has been rated as problematic. This issue affects an unknown code. The manipulation with an unknown input leads to a weak password vulnerability. Using CWE to declare the problem leads to CWE-521. The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts. The impact remains unknown. The summary by CVE is:

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.

The advisory is shared at huntr.com. The identification of this vulnerability is CVE-2025-1474 since 02/19/2025. The exploitation is known to be difficult. The attack may be initiated remotely. Additional levels of successful authentication are required for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1552 for this issue.

Upgrading to version 2.19.0 eliminates this vulnerability. Applying the patch 149c9e18aa219bc47e86b432e130e467a36f4a17 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• mlflow

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18

License

• open-source

Website

• Product: https://github.com/mlflow/mlflow/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion