PT-2024-18737 · Zenml · Zenml

Published 2024-04-15 · Updated 2025-05-12 · CVE-2024-2083

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions zenml-io/zenml (affected versions not specified)

Description A directory traversal issue exists, specifically within the "/api/v1/steps" endpoint. Attackers can exploit this by manipulating the logs URI path to fetch arbitrary file content, bypassing access restrictions. The issue arises due to the lack of validation for directory traversal patterns, allowing access to files outside the restricted directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-29

Related Identifiers

CVE-2024-2083

GHSA-6H3F-43VQ-53HJ

PYSEC-2024-247

Affected Products

Zenml

References · 10

• 🔥 https://huntr.com/bounties/f24b2216-6a4b-42a1-becb-9b47e6cf117f · Exploit
• https://github.com/zenml-io/zenml/commit/00e934f33a243a554f5f65b80eefd5ea5117367b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-2083 · Security Note
• https://osv.dev/vulnerability/GHSA-6h3f-43vq-53hj · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-247 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-2083 · Vendor Advisory
• https://github.com/zenml-io/zenml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/zenml/PYSEC-2024-247.yaml · Note
• https://t.me/cvenotify/121730 · Telegram Post
• https://twitter.com/CVEnew/status/1780039195148632330 · Twitter Post