CVE-2024-2171CWE-79

Stored XSS in zenml-io/zenml

Low · published June 6, 2024

CVSS v3.0
3.4
EPSS
0%
Percentile
29.3
In the wild
Unconfirmed
What it is

A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logo_url' field. By injecting malicious payloads into this field, an attacker could send harmful messages to other users, potentially compromising their accounts. The vulnerability affects version 0.55.3 and was fixed in version 0.56.2. The impact of exploiting this vulnerability could lead to user account compromise.

The record
Technical detail
CVSS v3.0
3.4 · LOW
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00367 · 29.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-06-06T18:22Z
EPSS history
Timeline
  • 06 JUN 18:22Z
    Stored XSS in zenml-io/zenml
    cvelistv5