Cyber Resilience

CVE-2025-1474

MediumPublic PoC

Published: 20 March 2025

Published
20 March 2025
Modified
27 March 2025
KEV Added
Patch
CVSS Score v3.1 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
EPSS Score 0.0010 27.9th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1474 is a medium-severity Weak Password Requirements (CWE-521) vulnerability in Lfprojects Mlflow. Its CVSS base score is 5.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Local Account (T1136.001); ranked at the 27.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

This vulnerability is AI-related — categorised as Other Platforms; in the Supply Chain and Deployment risk domain.

EU & UK References

Vulnerability details

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best…

more

practices for secure user account management. The issue is fixed in version 2.19.0.

CWE(s)

AI Security AnalysisAI

AI Category
Other Platforms
Risk Domain
Supply Chain and Deployment
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
Matched keywords: mlflow

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1136.001 Local Account Persistence
Adversaries may create a local account to maintain access to victim systems.
T1078.003 Local Accounts Stealth
Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
Why these techniques?

Vulnerability allows admins to create local MLflow user accounts without passwords, enabling adversaries with admin access to establish persistence by creating easily exploitable valid local accounts for unauthorized access.

Affected Assets

lfprojects
mlflow
≤ 2.19.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-521

Configuration settings can define and enforce strong password requirements to avoid weak policies.

addresses: CWE-521

IA policy establishes password requirements, directly addressing weak password requirements.

addresses: CWE-521

Ensuring authenticators have sufficient strength of mechanism for intended use addresses weak password requirements.

addresses: CWE-521

Organization-wide password and authentication policies are applied uniformly, preventing weak local password requirements.

addresses: CWE-521

Facilitated training and awareness of current practices improves definition and enforcement of sufficiently strong password requirements.

addresses: CWE-521

Dedicated security resources support deployment of strong authentication systems and enforcement of robust password policies.

addresses: CWE-521

Vulnerability scans assess password policies and weak credential requirements against benchmarks.

addresses: CWE-521

User documentation on maintaining security includes password requirements, directly mitigating weak password policies.

References