id: PYSEC-2023-260
modified: 2024-04-16T15:20:55.191003Z
published: 2023-12-07T05:15:00Z
aliases:
- CVE-2023-6568
- GHSA-vwhf-3v6x-wff8
details: A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow
  repository, specifically within the handling of the Content-Type header in POST
  requests. An attacker can inject malicious JavaScript code into the Content-Type
  header, which is then improperly reflected back to the user without adequate sanitization
  or escaping, leading to arbitrary JavaScript execution in the context of the victim's
  browser. The vulnerability is present in the mlflow/server/auth/__init__.py file,
  where the user-supplied Content-Type header is directly injected into a Python formatted
  string and returned to the user, facilitating the XSS attack.
affected:
- package:
    ecosystem: PyPI
    name: mlflow
    purl: pkg:pypi/mlflow
  ranges:
  - type: GIT
    events:
    - introduced: "0"
    - fixed: 28ff3f94994941e038f2172c6484b65dc4db6ca1
    repo: https://github.com/mlflow/mlflow
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.9.1
  versions:
  - 0.0.1
  - 0.1.0
  - 0.2.0
  - 0.2.1
  - 0.3.0
  - 0.4.0
  - 0.4.1
  - 0.4.2
  - 0.5.0
  - 0.5.1
  - 0.5.2
  - 0.6.0
  - 0.7.0
  - 0.8.0
  - 0.8.1
  - 0.8.2
  - 0.9.0
  - 0.9.0.1
  - 0.9.1
  - 1.0.0
  - 1.1.0
  - 1.1.1.dev0
  - 1.10.0
  - 1.11.0
  - 1.12.0
  - 1.12.1
  - "1.13"
  - 1.13.1
  - 1.14.0
  - 1.14.1
  - 1.15.0
  - 1.16.0
  - 1.17.0
  - 1.18.0
  - 1.19.0
  - 1.2.0
  - 1.20.0
  - 1.20.1
  - 1.20.2
  - 1.21.0
  - 1.22.0
  - 1.23.0
  - 1.23.1
  - 1.24.0
  - 1.25.0
  - 1.25.1
  - 1.26.0
  - 1.26.1
  - 1.27.0
  - 1.28.0
  - 1.29.0
  - 1.3.0
  - 1.30.0
  - 1.30.1
  - 1.4.0
  - 1.5.0
  - 1.6.0
  - 1.7.0
  - 1.7.1
  - 1.7.2
  - 1.8.0
  - 1.9.0
  - 1.9.1
  - 2.0.0
  - 2.0.0rc0
  - 2.0.1
  - 2.1.0
  - 2.1.1
  - 2.2.0
  - 2.2.1
  - 2.2.2
  - 2.3.0
  - 2.3.1
  - 2.3.2
  - 2.4.0
  - 2.4.1
  - 2.4.2
  - 2.5.0
  - 2.6.0
  - 2.7.0
  - 2.7.1
  - 2.8.0
  - 2.8.1
  - 2.9.0
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
references:
- type: EVIDENCE
  url: https://huntr.com/bounties/816bdaaa-8153-4732-951e-b0d92fddf709
- type: WEB
  url: https://huntr.com/bounties/816bdaaa-8153-4732-951e-b0d92fddf709
- type: FIX
  url: https://github.com/mlflow/mlflow/commit/28ff3f94994941e038f2172c6484b65dc4db6ca1
- type: ADVISORY
  url: https://github.com/advisories/GHSA-vwhf-3v6x-wff8