PT-2024-19019 · Zenml · Zenml

Published 2024-06-06 · Updated 2024-10-11 · CVE-2024-2171

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions zenml-io/zenml versions 0.55.3 through 0.55.3

Description A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the logo url field. By injecting malicious payloads into this field, an attacker could send harmful messages to other users, potentially compromising their accounts. The impact of exploiting this vulnerability could lead to user account compromise.

Recommendations For version 0.55.3, update to version 0.56.2 to resolve the issue. As a temporary workaround, consider restricting access to the logo url field until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-2171

GHSA-VWGF-7F9H-H499

PYSEC-2024-170

Affected Products

Zenml

References · 10

• 🔥 https://huntr.com/bounties/cee06a28-7e3b-460b-b504-69add838ebe8 · Exploit
• https://github.com/zenml-io/zenml/commit/68bcb3ba60cba9729c9713a49c39502d40fb945e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-2171 · Security Note
• https://osv.dev/vulnerability/CVE-2024-2171 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-170 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vwgf-7f9h-h499 · Vendor Advisory
• https://github.com/zenml-io/zenml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/zenml/PYSEC-2024-170.yaml · Note
• https://t.me/cvenotify/97873 · Telegram Post
• https://twitter.com/CVEnew/status/1798786694415561013 · Twitter Post