CVE-2024-2213

An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized account takeover by bypassing the standard password change verification process. The issue was fixed in version 0.56.3.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/zenml-io/zenml/commit/58cb3d987372c91eb605853c35325701733337c2	Patch
https://huntr.com/bounties/8f5534ac-fd08-4b8b-8c2e-35949aa36e48	Exploit Issue Tracking Patch Third Party Advisory
https://github.com/zenml-io/zenml/commit/58cb3d987372c91eb605853c35325701733337c2	Patch
https://huntr.com/bounties/8f5534ac-fd08-4b8b-8c2e-35949aa36e48	Exploit Issue Tracking Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:zenml:zenml:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-06-06 19:15

Updated : 2024-11-21 09:09

NVD link : CVE-2024-2213

Mitre link : CVE-2024-2213

CVE.ORG link : CVE-2024-2213

JSON object : View

Products Affected

zenml

zenml

CWE

CWE-287

Improper Authentication

NVD-CWE-Other

{"id": "CVE-2024-2213", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "published": "2024-06-06T19:15:53.890", "references": [{"url": "https://github.com/zenml-io/zenml/commit/58cb3d987372c91eb605853c35325701733337c2", "tags": ["Patch"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/8f5534ac-fd08-4b8b-8c2e-35949aa36e48", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "source": "security@huntr.dev"}, {"url": "https://github.com/zenml-io/zenml/commit/58cb3d987372c91eb605853c35325701733337c2", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://huntr.com/bounties/8f5534ac-fd08-4b8b-8c2e-35949aa36e48", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized account takeover by bypassing the standard password change verification process. The issue was fixed in version 0.56.3."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en las versiones de zenml-io/zenml hasta la 0.55.4 incluida. Debido a mecanismos de autenticaci\u00f3n inadecuados, un atacante con acceso a una sesi\u00f3n de usuario activa puede cambiar la contrase\u00f1a de la cuenta sin necesidad de conocer la contrase\u00f1a actual. Esta vulnerabilidad permite la apropiaci\u00f3n no autorizada de cuentas al pasar por alto el proceso est\u00e1ndar de verificaci\u00f3n de cambio de contrase\u00f1a. El problema se solucion\u00f3 en la versi\u00f3n 0.56.3."}], "lastModified": "2024-11-21T09:09:16.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zenml:zenml:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A24ABC9-62F4-4AAF-B7C3-C14F607AD79F", "versionEndExcluding": "0.56.3"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}