CVE-2025-1474
Published: 20 March 2025
Summary
CVE-2025-1474 is a medium-severity Weak Password Requirements (CWE-521) vulnerability in Lfprojects Mlflow. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Local Account (T1136.001); ranked at the 27.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as Other Platforms; in the Supply Chain and Deployment risk domain.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6810
Vulnerability details
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best…
more
practices for secure user account management. The issue is fixed in version 2.19.0.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Other Platforms
- Risk Domain
- Supply Chain and Deployment
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: mlflow
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability allows admins to create local MLflow user accounts without passwords, enabling adversaries with admin access to establish persistence by creating easily exploitable valid local accounts for unauthorized access.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Configuration settings can define and enforce strong password requirements to avoid weak policies.
IA policy establishes password requirements, directly addressing weak password requirements.
Ensuring authenticators have sufficient strength of mechanism for intended use addresses weak password requirements.
Organization-wide password and authentication policies are applied uniformly, preventing weak local password requirements.
Facilitated training and awareness of current practices improves definition and enforcement of sufficiently strong password requirements.
Dedicated security resources support deployment of strong authentication systems and enforcement of robust password policies.
Vulnerability scans assess password policies and weak credential requirements against benchmarks.
User documentation on maintaining security includes password requirements, directly mitigating weak password policies.