PT-2024-4534 · Unknown · Zenml Server
Published
2024-02-01
·
Updated
2025-05-12
·
CVE-2024-25723
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
ZenML Server versions prior to 0.46.7
ZenML Server versions 0.44.4, 0.43.1, and 0.42.2 are patched and not vulnerable, so the actual vulnerable range is any version before 0.46.7, excluding the mentioned patched versions. However, since 0.44.4, 0.43.1, and 0.42.2 are specifically mentioned as patched, it implies versions before these are vulnerable, but for clarity and following instructions precisely, we focus on the range provided directly related to the vulnerability.
Description:
The issue is related to the
/api/v1/users/{user name or id}/activate REST API endpoint, which allows access based on a valid user name or id along with a new password in the request body, leading to remote privilege escalation. The vulnerability is associated with deficiencies in the access control mechanism of the ZenML framework for creating machine learning pipelines.Recommendations:
For versions prior to 0.46.7, update to version 0.46.7 or later to resolve the issue.
As a temporary workaround, consider restricting access to the
/api/v1/users/{user name or id}/activate API endpoint until a patch is applied.
Avoid using the user name or id parameter in the affected API endpoint until the issue is resolved.Exploit
Fix
LPE
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Zenml Server