CVE-2024-2171lowCWE-79

CVE-2024-2171: low-severity vulnerability in zenml-io/zenml

Stored XSS in zenml-io/zenml

Published · Updated

Follow this CVE+ Monitor zenml-io/zenml+ Monitor zenml

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.4epss 0.4%
A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logo_url' field. By injecting malicious payloads into this field, an attacker could send harmful messages to other users, potentially compromising their accounts. The vulnerability affects version 0.55.3 and was fixed in version 0.56.2. The impact of exploiting this vulnerability could lead to user account compromise.
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N
Affected products
zenml-io · zenml-io/zenml
Related CVEs — zenml-io/zenml

In the same product, most dangerous first.

CVE-2024-2083CRITICALDirectory Traversal in zenml-io/zenmlEPSS 37.2%CVE-2024-9340HIGHDenial of Service (DoS) via Multipart Boundary in zenml-io/zenmlEPSS 1.0%CVE-2024-2035MEDIUMImproper Authorization in zenml-io/zenmlEPSS 0.6%CVE-2024-4311MEDIUMLack of login attempt rate-limiting in zenml-io/zenmlEPSS 0.5%CVE-2024-2260MEDIUMSession Fixation Vulnerability in zenml-io/zenmlEPSS 0.4%CVE-2024-4680LOWInsufficient Session Expiration in zenml-io/zenmlEPSS 0.4%