CVE-2024-2928

CVE-2024-2928 is a Local File Inclusion (LFI) vulnerability affecting mlflow/mlflow versions prior to 2.11.3. It allows an unauthenticated attacker to read arbitrary files on the local file system, such as /etc/passwd, by manipulating URI fragments with directory traversal sequences. Rated with a CVSS score of 7.5 (HIGH), this vulnerability has a low attack complexity and requires no user interaction, making it easily exploitable for sensitive information disclosure. Its high EPSS score of 0.91552 and FAUCET Risk Score of 99/100 indicate a significant likelihood of exploitation. While not listed in CISA's KEV catalog, exploit intelligence shows Nuclei templates are available for this path traversal, suggesting potential for widespread use. There is currently no evidence of active exploitation, Metasploit modules, or significant community discussion.