{"data":{"id":"f40491fd-d1fc-435b-bd89-c133c54f48cd","title":"CVE-2025-1474: In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This…","summary":"CVE-2025-1474 affects mlflow/mlflow version 2.18. An admin can create a new user account without setting a password, which the source says could lead to unauthorized access and violates best practices for user account management. The weakness is classified as CWE-521, Weak Password Requirements.","solution":"The issue is fixed in version 2.19.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-1474","publishedAt":"2025-03-20T14:15:54.037Z","cveId":"CVE-2025-1474","cweIds":["CWE-521"],"cvssScore":"5.5","cvssSeverity":"medium","severity":"medium","attackType":[],"issueType":"vulnerability","affectedPackages":["mlflow@< 2.19.0 (fixed: 2.19.0)"],"affectedPackageNames":["mlflow"],"affectedPackageRefs":["pypi:mlflow"],"affectedVendors":[],"affectedVendorsRaw":["MLflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"MLflow admin can create user accounts without setting a password","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00366,"epssCheckedAt":"2026-11-05T00:11:43.183Z","kevDateAdded":null,"advisoryAliases":["GHSA-4rj2-9gcx-5qhx"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:54:07.299Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-12-11T09:49:32.119Z","daysToFix":-99,"fixCheckedAt":"2026-10-29T21:44:51.549Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"mlflow","fixedVersion":"2.19.0","matchedVersion":"2.19.0","fixReleasedAt":"2024-12-11T09:49:32.119Z","daysToFix":-99,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:44:51.389Z"}]}}