converted mlflow cve-2023-6014 to templated

[robert-doyensec]

No changes to testbed

{
  "scanStatus": "SUCCEEDED",
  "scanFindings": [{
    "targetInfo": {
      "networkEndpoints": [{
        "type": "IP_HOSTNAME_PORT",
        "ipAddress": {
          "addressFamily": "IPV4",
          "address": "192.168.65.254"
        },
        "port": {
          "portNumber": 8081
        },
        "hostname": {
          "name": "host.docker.internal"
        }
      }]
    },
    "networkService": {
      "networkEndpoint": {
        "type": "IP_HOSTNAME_PORT",
        "ipAddress": {
          "addressFamily": "IPV4",
          "address": "192.168.65.254"
        },
        "port": {
          "portNumber": 8081
        },
        "hostname": {
          "name": "host.docker.internal"
        }
      },
      "transportProtocol": "TCP",
      "serviceName": "http",
      "serviceContext": {
        "webServiceContext": {
        }
      }
    },
    "vulnerability": {
      "mainId": {
        "publisher": "TSUNAMI_COMMUNITY",
        "value": "CVE_2023_6014"
      },
      "relatedId": [{
        "publisher": "CVE",
        "value": "CVE-2023-6014"
      }],
      "severity": "CRITICAL",
      "title": "MLFlow Auth Bypasss Vulnerability (CVE-2023-6014)",
      "description": "On MLflow versions prior to 2.8.0, unauthenticated users are able to arbitrarily create an account in MLflow server or MLflow UI by bypassing any authentication requirement.\n",
      "recommendation": "Update the MLflow instances to a version that provides a fix which is newer than version 2.8.0, and check the user list for potential users that were created by exploiting this vulnerability. Note that there are later CVEs, so it\u0027s best to update to the latest version.\n IMPORTANT NOTE: This scan confirmed the vulnerability by creating a user with username \u0027TSUNAMI_USER\u0027 and an insecure password, so make sure you delete that user."
    }
  }],
  "scanStartTimestamp": "2026-06-25T15:02:20.335Z",
  "scanDuration": "1.219s",
  "fullDetectionReports": {
    "detectionReports": [{
      "targetInfo": {
        "networkEndpoints": [{
          "type": "IP_HOSTNAME_PORT",
          "ipAddress": {
            "addressFamily": "IPV4",
            "address": "192.168.65.254"
          },
          "port": {
            "portNumber": 8081
          },
          "hostname": {
            "name": "host.docker.internal"
          }
        }]
      },
      "networkService": {
        "networkEndpoint": {
          "type": "IP_HOSTNAME_PORT",
          "ipAddress": {
            "addressFamily": "IPV4",
            "address": "192.168.65.254"
          },
          "port": {
            "portNumber": 8081
          },
          "hostname": {
            "name": "host.docker.internal"
          }
        },
        "transportProtocol": "TCP",
        "serviceName": "http",
        "serviceContext": {
          "webServiceContext": {
          }
        }
      },
      "detectionTimestamp": "2026-06-25T15:02:21.539Z",
      "detectionStatus": "VULNERABILITY_VERIFIED",
      "vulnerability": {
        "mainId": {
          "publisher": "TSUNAMI_COMMUNITY",
          "value": "CVE_2023_6014"
        },
        "relatedId": [{
          "publisher": "CVE",
          "value": "CVE-2023-6014"
        }],
        "severity": "CRITICAL",
        "title": "MLFlow Auth Bypasss Vulnerability (CVE-2023-6014)",
        "description": "On MLflow versions prior to 2.8.0, unauthenticated users are able to arbitrarily create an account in MLflow server or MLflow UI by bypassing any authentication requirement.\n",
        "recommendation": "Update the MLflow instances to a version that provides a fix which is newer than version 2.8.0, and check the user list for potential users that were created by exploiting this vulnerability. Note that there are later CVEs, so it\u0027s best to update to the latest version.\n IMPORTANT NOTE: This scan confirmed the vulnerability by creating a user with username \u0027TSUNAMI_USER\u0027 and an insecure password, so make sure you delete that user."
      }
    }]
  },
  "reconnaissanceReport": {
    "targetInfo": {
      "networkEndpoints": [{
        "type": "IP_HOSTNAME_PORT",
        "ipAddress": {
          "addressFamily": "IPV4",
          "address": "192.168.65.254"
        },
        "port": {
          "portNumber": 8081
        },
        "hostname": {
          "name": "host.docker.internal"
        }
      }]
    },
    "networkServices": [{
      "networkEndpoint": {
        "type": "IP_HOSTNAME_PORT",
        "ipAddress": {
          "addressFamily": "IPV4",
          "address": "192.168.65.254"
        },
        "port": {
          "portNumber": 8081
        },
        "hostname": {
          "name": "host.docker.internal"
        }
      },
      "transportProtocol": "TCP",
      "serviceName": "http",
      "serviceContext": {
        "webServiceContext": {
        }
      }
    }]
  },
  "targetAlive": true
}

[giacomo-doyensec]

The files are in templated/templateddetector/plugins/cve/2024 but should be in templated/templateddetector/plugins/cve/2023.

Added a couple more suggestions below:

[giacomo-doyensec]

Suggested change

	title: "MLFlow Auth Bypasss Vulnerability (CVE-2023-6014)"
	title: "MLFlow Auth Bypass Vulnerability (CVE-2023-6014)"

[giacomo-doyensec]

Since the username is hardcoded, and there are no cleanup actions, subsequent scan of the same target would result in false positive (error in creating the user twice). I would both:

• add a cleanup action to the request
• add uniqueness to the username (e.g.TSUNAMI_USER_{{ T_UTL_CURRENT_TIMESTAMP_MS }}) so it does not leave the system in an inconsistent state if the cleanup action fails