ConfirmedA court, a regulator or the organization itself has stated the core facts, or the record cites a court or regulator source.
Weak password requirements in MLflow signup
MLflow's signup form accepted passwords and usernames with a minimum length of only 4 characters, creating a security risk. The issue was fixed by implementing a 4-character minimum length requirement in the form.
AII-1001-859013 sources ↓
What happened
MLflow's signup form allowed usernames and passwords with a minimum length of only 4 characters.
Reported impact
Weak password requirements increase the risk of brute force attacks and unauthorized account access.
Index analysis
The vulnerability was addressed by adding a minlength attribute of 4 characters to both username and password input fields in the signup form.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.
github.com
https://github.com/mlflow/mlflow/commit/149c9e18aa219bc47e86b432e130e467a36f4a17