Vulnerability · Published Nov 14, 2024 · Assigned by @huntr_ai
CVE-2024-4311Lack of login attempt rate-limiting in zenml-io/zenml
Medium 5.4
In plain English
A medium-severity resource allocation without limits in zenml-io/zenml from zenml-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to take over the user's account. This vulnerability is due to the absence of rate-limiting on the '/api/v1/current-user' endpoint, which does not restrict the number of attempts an attacker can make to guess the current password. Successful exploitation results in the attacker being able to change the password and take control of the account.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | zenml | 0.57.0rc2 | GHSA-j3vq-pmp5-r5xj |
| PyPI | zenml | 0.57.0rc2 | PYSEC-2026-2070 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| zenml-io | zenml-io/zenml | unspecified – before 0.57.0 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H