CVE-2024-2213lowCWE-620

CVE-2024-2213: low-severity vulnerability in zenml-io/zenml

Improper Authentication in zenml-io/zenml

Published · Updated

Follow this CVE+ Monitor zenml-io/zenml+ Monitor zenml

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.3epss 0.2%
An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized account takeover by bypassing the standard password change verification process. The issue was fixed in version 0.56.3.
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
zenml-io · zenml-io/zenml
Related CVEs — zenml-io/zenml

In the same product, most dangerous first.

CVE-2024-2083CRITICALDirectory Traversal in zenml-io/zenmlEPSS 37.2%CVE-2024-9340HIGHDenial of Service (DoS) via Multipart Boundary in zenml-io/zenmlEPSS 1.0%CVE-2024-2035MEDIUMImproper Authorization in zenml-io/zenmlEPSS 0.6%CVE-2024-4311MEDIUMLack of login attempt rate-limiting in zenml-io/zenmlEPSS 0.5%CVE-2024-2260MEDIUMSession Fixation Vulnerability in zenml-io/zenmlEPSS 0.4%CVE-2024-4680LOWInsufficient Session Expiration in zenml-io/zenmlEPSS 0.4%