Improper Authentication Affecting zenml package, versions [,0.56.3)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.04% (11th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-ZENML-7218853
- published 7 Jun 2024
- disclosed 6 Jun 2024
- credit Lê Ngọc Hoa
Introduced: 6 Jun 2024
CVE-2024-2213 Open this link in a new tabHow to fix?
Upgrade zenml to version 0.56.3 or higher.
Overview
zenml is a ZenML: Write production-ready ML code.
Affected versions of this package are vulnerable to Improper Authentication. An attacker with access to an active user session can change the account password without needing to know the current password, leading to unauthorized account takeover by bypassing the standard password change verification process.
References
CVSS Scores
version 3.1