AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

ZenMLGHSA-j527-v579-m98h

Improper authentication in zenml

ZenML

CVE-2024-2213 · Published Jun 6, 2024 · updated Oct 16, 2025

Low3.3
Fix: upgrade to 0.56.3 or later
GitHub advisory

An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized account takeover by bypassing the standard password change verification process. The issue was fixed in version 0.56.3.

Affected versions

PackageAffectedFixed in
zenml
PyPI
< 0.56.30.56.3
Details and references
CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-287, CWE-620
Also known as
CVE-2024-2213, PYSEC-2024-193

More ZenML advisories

All ZenML
Medium 4.3Jun 24, 2024Improper line feed handling in zenmlCVE-2024-4460fixed in 0.57.1Low 3.9Jun 8, 2024zenml-io/zenml does not expire the session after password resetCVE-2024-4680no fix yetMedium 6.5Jun 6, 2024Improper authorization in zenmlCVE-2024-2035fixed in 0.56.2Low 3.1Jun 6, 2024Race condition in zenmlCVE-2024-2032fixed in 0.55.5Medium 4.3Jun 6, 2024Clickjacking in zenmlCVE-2024-2383fixed in 0.56.3Low 3.4Jun 6, 2024Cross site scripting in zenmlCVE-2024-2171fixed in 0.56.2