Vulnerability · Published Jun 6, 2024 · Assigned by @huntr_ai
CVE-2024-2035Improper Authorization in zenml-io/zenml
Medium 6.5
In plain English
A medium-severity missing authorization in zenml-io/zenml from zenml-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the `active` status of user accounts to false, effectively deactivating them. This issue affects version 0.55.3 and was fixed in version 0.56.2. The impact of this vulnerability is significant as it allows for the deactivation of admin accounts, potentially disrupting the functionality and security of the application.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | zenml | 0.56.2 | GHSA-9x88-4jg8-4vf7 |
| PyPI | zenml | 0.56.2 | PYSEC-2024-169 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| zenml-io | zenml-io/zenml | unspecified – before 0.56.2 |
Weakness: CWE-862 · Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H