{"data":{"id":"11759f9e-705c-448d-a831-4c80a65fe9f1","title":"CVE-2025-1473: A Cross-Site Request Forgery (CSRF) vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to…","summary":"CVE-2025-1473 is a Cross-Site Request Forgery (CSRF) flaw in the Signup feature of mlflow/mlflow versions 2.17.0 through 2.20.1. An attacker can use it to create a new account, which the malicious user can then use to perform unauthorized actions.","solution":"The source text lists a patch reference at https://github.com/mlflow/mlflow/commit/ecfa61cb43d3303589f3b5834fd95991c9706628 but does not state a fixed version or configuration change.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-1473","publishedAt":"2025-03-20T14:15:53.903Z","cveId":"CVE-2025-1473","cweIds":["CWE-352"],"cvssScore":"7.1","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["mlflow@>= 2.17.0, < 2.20.3 (fixed: 2.20.3)"],"affectedPackageNames":["mlflow"],"affectedPackageRefs":["pypi:mlflow"],"affectedVendors":[],"affectedVendorsRaw":["MLflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"mlflow Cross-Site Request Forgery in the Signup feature","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00221,"epssCheckedAt":"2026-11-04T18:09:14.050Z","kevDateAdded":null,"advisoryAliases":["GHSA-969w-gqqr-g6j3"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:54:07.832Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-02-26T07:40:53.628Z","daysToFix":-22,"fixCheckedAt":"2026-10-29T21:44:52.312Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"mlflow","fixedVersion":"2.20.3","matchedVersion":"2.20.3","fixReleasedAt":"2025-02-26T07:40:53.628Z","daysToFix":-22,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:44:52.162Z"}]}}