Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-1474

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.

Published

2025-03-20T10:15:54.037

Last Modified

2025-03-27T15:36:42.540

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 5.5 (MEDIUM)

Weaknesses
  • Type: Primary
    CWE-521
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application lfprojects mlflow < 2.19.0 Yes
References