PT-2024-19499 · Zenml · Zenml

Published 2024-04-15 · Updated 2025-06-12 · CVE-2024-2260

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions zenml-io/zenml (affected versions not specified)

Description A session fixation issue exists in the zenml-io/zenml application. The problem arises because JWT tokens used for user authentication are not invalidated upon logout. This allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2024-2260

GHSA-G3R5-72HF-P7P2

PYSEC-2024-254

Affected Products

Zenml

References · 10

• 🔥 https://huntr.com/bounties/2d0856ec-ed73-477a-8ea2-d5d4f15cf167 · Exploit
• https://github.com/zenml-io/zenml/commit/68bcb3ba60cba9729c9713a49c39502d40fb945e · Patch
• https://osv.dev/vulnerability/GHSA-g3r5-72hf-p7p2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2260 · Security Note
• https://osv.dev/vulnerability/CVE-2024-2260 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-254 · Vendor Advisory
• https://github.com/zenml-io/zenml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/zenml/PYSEC-2024-254.yaml · Note
• https://t.me/cvenotify/125561 · Telegram Post
• https://twitter.com/CVEnew/status/1780039202526408725 · Twitter Post