{"data":{"id":"a08cf275-eb12-4655-aaf0-748a9315c938","title":"CVE-2023-6018: An attacker can overwrite any file on the server hosting MLflow without any authentication.","summary":"CVE-2023-6018 is classified under CWE-78, OS Command Injection, and was reported by huntr.dev. The source states that an attacker can overwrite any file on the server hosting MLflow without any authentication. NIST has not yet provided an NVD assessment, and no affected versions are listed in the source text.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-6018","publishedAt":"2023-11-16T21:15:34.880Z","cveId":"CVE-2023-6018","cweIds":["CWE-78"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["mlflow@<= 2.8.1 (fixed: 2.9.2)"],"affectedPackageNames":["mlflow"],"affectedPackageRefs":["pypi:mlflow"],"affectedVendors":[],"affectedVendorsRaw":["MLflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"MLflow arbitrary file overwrite without authentication","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.47874,"epssCheckedAt":"2026-11-04T12:08:34.749Z","kevDateAdded":null,"advisoryAliases":["GHSA-5p3h-7fwh-92rc"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:56:41.744Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2023-12-14T05:30:49.658Z","daysToFix":28,"fixCheckedAt":"2026-10-29T21:46:41.783Z","capecIds":["CAPEC-88"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"mlflow","fixedVersion":"2.9.2","matchedVersion":"2.9.2","fixReleasedAt":"2023-12-14T05:30:49.658Z","daysToFix":28,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:46:41.633Z"}]}}