3.3

CVE-2024-2213

Exploit

Improper Authentication in zenml-io/zenml

An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized account takeover by bypassing the standard password change verification process. The issue was fixed in version 0.56.3.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zenml ≫ Zenml Version < 0.56.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.24% 0.149
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 3.3 1.8 1.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
security@huntr.dev 3.3 1.8 1.4
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-620 Unverified Password Change

When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

https://github.com/zenml-io/zenml/commit/58cb3d987372c91eb605853c35325701733337c2
Patch
https://huntr.com/bounties/8f5534ac-fd08-4b8b-8c2e-35949aa36e48
Patch
Third Party Advisory
Exploit
Issue Tracking