CVE-2025-1474 LOW

CVE-2025-1474: Weak Password Requirements in mlflow/mlflow

Vendor Mlflow
Product mlflow/mlflow
Weakness CWE-521
Published March 20, 2025
Last update March 20, 2025
View on NVD All CVEs

CVSS base score

3.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.

Key dates

02Disclosure timeline

March 20, 2025 CVE published
March 20, 2025 Record updated