CVE-2024-2260CWE-384

Session Fixation Vulnerability in zenml-io/zenml

Medium · published April 16, 2024

CVSS v3.0
4.2
EPSS
0%
Percentile
37.0
In the wild
Unconfirmed
What it is

A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token.

The record
Technical detail
CVSS v3.0
4.2 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00437 · 37.0th percentile
Weakness
CWE-384 · Session Fixation
Published
2024-04-16T00:00Z
EPSS history
Timeline
  • 16 APR 00:00Z
    Session Fixation Vulnerability in zenml-io/zenml
    cvelistv5