CVE-2024-2213CWE-620

Improper Authentication in zenml-io/zenml

Low · published June 6, 2024

CVSS v3.0
3.3
EPSS
0%
Percentile
14.6
In the wild
Unconfirmed
What it is

An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized account takeover by bypassing the standard password change verification process. The issue was fixed in version 0.56.3.

The record
Technical detail
CVSS v3.0
3.3 · LOW
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00243 · 14.6th percentile
Weakness
CWE-620 · Unverified Password Change
Published
2024-06-06T18:19Z
EPSS history
Timeline
  • 06 JUN 18:19Z
    Improper Authentication in zenml-io/zenml
    cvelistv5