Vulnerability · Published Jun 8, 2024 · Assigned by @huntr_ai
CVE-2024-4680Insufficient Session Expiration in zenml-io/zenml
Low 3.9
In plain English
A low-severity security flaw in zenml-io/zenml from zenml-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Official description
A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access to a compromised account without the victim's ability to revoke this access. This issue was observed in a self-hosted ZenML deployment via Docker, where after changing the password from one browser, the session remained active and usable in another browser without requiring re-authentication.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | zenml | no fix listed | GHSA-99hm-86h7-gr3g |
| PyPI | zenml | no fix listed | PYSEC-2026-2069 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| zenml-io | zenml-io/zenml | unspecified – through latest |
Weakness: CWE-613 · Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L