Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-25723

Good to know:

icon
icon

Date: February 26, 2024

ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2.

Language: Python

Severity Score

Related Resources (7)

https://github.com/zenml-io/zenml/compare/0.42.1...0.42.2
https://nvd.nist.gov/vuln/detail/CVE-2024-25723
https://github.com/zenml-io/zenml/compare/0.43.0...0.43.1
https://www.zenml.io/blog/critical-security-update-for-zenml-users
https://github.com/zenml-io/zenml
https://github.com/zenml-io/zenml/compare/0.44.3...0.44.4
https://www.mend.io/vulnerability-database/CVE-2024-25723

Severity Score

Weakness Type (CWE)

Improper Access Control

CWE-284

Top Fix

icon

Upgrade Version

Upgrade to version zenml - 0.43.1;zenml - 0.44.4;zenml - 0.42.2

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

Do you need more information?

Contact Us