CVE-2024-3099

CVE-2024-3099 is a medium-severity vulnerability affecting mlflow/mlflow version 2.11.1, allowing authenticated attackers to create multiple models with the same name by exploiting URL encoding. This can lead to Denial of Service (DoS) by preventing users from accessing the intended model, or data model poisoning if a user inadvertently utilizes a malicious model. The issue stems from inadequate validation of model names, enabling URL-encoded names to be treated as distinct. While the CVSS score is 5.4, indicating a medium risk with low attack complexity and potential for data integrity and availability impact, there is currently no evidence of active exploitation, public exploit code, or significant community discussion.