ZenMLGHSA-3434-hc3m-8mmm
Reflected Cross-Site Scripting (XSS) in zenml
Medium6.1CVE-2024-5062 · Published Jun 30, 2024 · updated Jan 21, 2025
A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web page generation, specifically within the survey redirect parameter. This flaw allows an attacker to redirect users to a specified URL after completing a survey, without proper validation of the 'redirect' parameter. Consequently, an attacker can execute arbitrary JavaScript code in the context of the user's browser session. This vulnerability could be exploited to steal cookies, potentially leading to account takeover.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| zenml PyPI | >= 0.57.1, < 0.58.0 | 0.58.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- CVE-2024-5062, PYSEC-2024-176
More ZenML advisories
All ZenML| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jun 242024 | Improper line feed handling in zenml Medium4.3Jun 24, 2024 | Medium4.3 | 0.57.1 |
| Jun 82024 | zenml-io/zenml does not expire the session after password resetLow3.9Jun 8, 2024 | Low3.9 | No fix yet |
| Jun 62024 | Improper authorization in zenmlMedium6.5Jun 6, 2024 | Medium6.5 | 0.56.2 |
| Jun 62024 | Race condition in zenmlLow3.1Jun 6, 2024 | Low3.1 | 0.55.5 |
| Jun 62024 | Improper authentication in zenmlLow3.3Jun 6, 2024 | Low3.3 | 0.56.3 |
| Jun 62024 | Clickjacking in zenmlMedium4.3Jun 6, 2024 | Medium4.3 | 0.56.3 |