PT-2024-20109 · Zenml Io · Zenml

Published 2024-06-06 · Updated 2024-10-11 · CVE-2024-2383

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions zenml-io/zenml versions up to and including 0.55.5

Description A clickjacking issue exists due to the application's failure to set appropriate X-Frame-Options or Content-Security-Policy HTTP headers. This allows an attacker to embed the application UI within an iframe on a malicious page, potentially leading to unauthorized actions by tricking users into interacting with the interface under the attacker's control.

Recommendations For versions up to and including 0.55.5, update to version 0.56.3 to resolve the issue. As a temporary workaround, consider restricting access to the application UI to minimize the risk of exploitation.

Exploit

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2024-2383

GHSA-MQ73-G4QR-FGCQ

PYSEC-2024-194

Affected Products

Zenml

References · 9

• 🔥 https://huntr.com/bounties/22d26f5a-c0ae-4344-aa7d-08ff5ada3963 · Exploit
• https://github.com/zenml-io/zenml/commit/f863fde1269bc355951f8cfc826c0244d88ad5e9 · Patch
• https://osv.dev/vulnerability/CVE-2024-2383 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-194 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mq73-g4qr-fgcq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2383 · Security Note
• https://github.com/zenml-io/zenml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/zenml/PYSEC-2024-194.yaml · Note
• https://twitter.com/CVEnew/status/1798786712870764897 · Twitter Post