Cyber Resilience

CVE-2024-2928

Path Traversal in Lfprojects Mlflow ≤ 2.11.3

Public PoCPath Traversal
Published
06 June 2024
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.22 97th percentile
Risk Priority 83 floored blend · peak EPSS

Summary

CVE-2024-2928 is a high-severity Path Traversal: '\..\filename' (CWE-29) vulnerability in Lfprojects Mlflow. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

This vulnerability is AI-related — categorised as Other AI Platforms; in the Privacy and Disclosure risk domain.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

A Local File Inclusion vulnerability affects the mlflow/mlflow project in version 2.9.2. The flaw stems from insufficient validation of URI fragments against directory traversal sequences such as '../', allowing an attacker to read arbitrary local files including sensitive system files like /etc/passwd. It represents a bypass of an earlier patch that had addressed similar manipulation only within the query string portion of URIs. The issue is tracked under CWE-22 and CWE-29 and carries a CVSS 3.1 score of 7.5.

An unauthenticated remote attacker can supply a crafted URI fragment to the affected MLflow instance and retrieve arbitrary files from the underlying filesystem. Successful exploitation yields disclosure of confidential data without requiring user interaction or elevated privileges.

The referenced GitHub commits and huntr.dev bounty reports document the remediation, which was released in version 2.11.3 and applies comprehensive URI validation covering fragments in addition to query strings. The EPSS score has remained consistently high near 0.91 since disclosure.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An…

more

attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like '/etc/passwd'. The vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI's query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks.

CWE(s)

AI Security AnalysisAI

AI Category
Other AI Platforms
Risk Domain
Privacy and Disclosure
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
MLflow is an open-source platform for managing the machine learning lifecycle, including experiment tracking, model packaging, and deployment, fitting the 'Other Platforms' category for AI/ML platforms.

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
T1083 File and Directory Discovery Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-6831Same product: Lfprojects Mlflow
CVE-2024-3573Same product: Lfprojects Mlflow
CVE-2024-3848Same product: Lfprojects Mlflow
CVE-2023-1177Same product: Lfprojects Mlflow
CVE-2025-15036Same product: Lfprojects Mlflow
CVE-2024-1483Same product: Lfprojects Mlflow
CVE-2024-0520Same product: Lfprojects Mlflow
CVE-2024-1558Same product: Lfprojects Mlflow
CVE-2024-1560Same product: Lfprojects Mlflow
CVE-2024-1593Same product: Lfprojects Mlflow

Affected Assets

lfprojects
mlflow
≤ 2.11.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V5.3.2

Mitigating Controls (NIST 800-53 r5) AI

Enforces the intended directory access authorizations that path traversal would otherwise bypass.

Input validation directly neutralizes the '\..\filename' sequence before pathname resolution occurs.

Least privilege reduces the impact of any unauthorized file access obtained via traversal.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require input validation and path sanitization that block this traversal vector.

PR.PS-02 partial match
prevents

Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.

PR.AA-05 none match
prevents

PR.AA-05 defines and reviews access policies but does not address code-level pathname neutralization, so neither direction prevents CWE-22.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can discover path-traversal flaws but does not itself prevent them in production code.

prevents

Secure SDLC mandates input validation and path sanitization that directly prevent path traversal.

prevents

Application security requirements can mandate input validation and path canonicalization to block traversal sequences.

prevents

Secure architecture principles include directory sandboxing and safe file-access design that mitigate path traversal.

prevents

Secure coding standards directly require neutralizing path traversal sequences such as '\..\filename'.

mitigates

Information access restriction limits which files an application may read or write.

References