An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.
Weakness
The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mlflow | Lfprojects | * | * |