CVE-2025-14279 (CNNVD-202601-1855)
中文标题:
MLflow 访问控制错误漏洞
英文标题:
MLFlow versions up to and including 3.4.0 are vulnerable to DNS rebinding attacks due to a lack of O
漏洞描述
中文描述:
MLflow是MLflow开源的一个简化机器学习开发的平台，包括跟踪实验、将代码打包成可重复的运行以及共享和部署模型。 MLflow 3.4.0及之前版本存在访问控制错误漏洞，该漏洞源于MLFlow REST服务器缺少Origin标头验证，可能导致恶意网站绕过同源策略保护并对REST端点执行未授权调用，从而引发数据渗漏、破坏或篡改。
英文描述:
MLFlow versions up to and including 3.4.0 are vulnerable to DNS rebinding attacks due to a lack of Origin header validation in the MLFlow REST server. This vulnerability allows malicious websites to bypass Same-Origin Policy protections and execute unauthorized calls against REST endpoints. An attacker can query, update, and delete experiments via the affected endpoints, leading to potential data exfiltration, destruction, or manipulation. The issue is resolved in version 3.5.0.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| mlflow | mlflow/mlflow | - | < 3.5.0 | - |
cpe:2.3:a:mlflow:mlflow_mlflow:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| NVD | nvd_CVE-2025-14279 |
2026-01-13 03:00:04 | 2026-01-13 06:36:16 |
| CVE | cve_CVE-2025-14279 |
2026-01-13 07:32:33 | 2026-01-13 07:40:53 |
| CNNVD | cnnvd_CNNVD-202601-1855 |
2026-01-15 01:52:30 | 2026-01-15 01:53:11 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 授权问题
- cnnvd_id: 未提取 -> CNNVD-202601-1855
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 0 -> 1
- data_sources: ['nvd'] -> ['cve', 'nvd']