MLflow Statsmodels load can run code after user action (CVE-2024-37052)
The target must open a malicious page or file; ZDI rates the flaw CVSS 7.8.
50
CVE-2024-37052
- CVSS 3.1
- 8.8 high
- EPSS
- <1%p53
- Published
- ·
- Modified
Description · NVD
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with.