ZenML up to 0.42.1/0.43.0/0.44.3/0.46.6 on Python REST API Endpoint activate privilege escalation

Summaryinfo

A vulnerability described as critical has been identified in ZenML up to 0.42.1/0.43.0/0.44.3/0.46.6 on Python. This issue affects some unknown processing of the file /api/v1/users/{user_name_or_id}/activate of the component REST API Endpoint. Executing a manipulation can lead to an unknown weakness. This vulnerability is handled as CVE-2024-25723. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in ZenML up to 0.42.1/0.43.0/0.44.3/0.46.6 on Python. It has been declared as critical. This vulnerability affects an unknown code block of the file /api/v1/users/{user_name_or_id}/activate of the component REST API Endpoint. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2.

The weakness was released 02/27/2024. The advisory is shared for download at zenml.io. This vulnerability was named CVE-2024-25723 since 02/11/2024. There are known technical details, but no exploit is available.

Upgrading to version 0.42.2, 0.43.1, 0.44.4 or 0.46.7 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• ZenML

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37
• 0.38
• 0.39
• 0.40
• 0.41
• 0.42
• 0.42.0
• 0.42.1
• 0.43.0
• 0.44.0
• 0.44.1
• 0.44.2
• 0.44.3
• 0.46.0
• 0.46.1
• 0.46.2
• 0.46.3
• 0.46.4
• 0.46.5
• 0.46.6

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion