CVE-2024-2213

Published: Jun 6, 2024Modified: Jun 17, 2026

3.3

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 1.8 / Impact: 1.4

Source: NVD

Description

An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized account takeover by bypassing the standard password change verification process. The issue was fixed in version 0.56.3.

Affected (1)

Products: Zenml: Zenml

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Zenml Zenml	Before 0.56.3

Related CWEs

Unverified Password Change

When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

References (4)

https://github.com/zenml-io/zenml/commit/58cb3d987372c91eb605853c35325701733337c2

Source: security@huntr.dev

Patch

https://huntr.com/bounties/8f5534ac-fd08-4b8b-8c2e-35949aa36e48

Source: security@huntr.dev

ExploitIssue TrackingPatchThird Party Advisory

https://github.com/zenml-io/zenml/commit/58cb3d987372c91eb605853c35325701733337c2

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://huntr.com/bounties/8f5534ac-fd08-4b8b-8c2e-35949aa36e48

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingPatchThird Party Advisory

Timeline

No history available yet.