id: PYSEC-2024-193
modified: 2025-01-19T13:22:31.701775Z
published: 2024-06-06T19:15:53Z
aliases:
- CVE-2024-2213
- GHSA-j527-v579-m98h
details: An issue was discovered in zenml-io/zenml versions up to and including 0.55.4.
  Due to improper authentication mechanisms, an attacker with access to an active
  user session can change the account password without needing to know the current
  password. This vulnerability allows for unauthorized account takeover by bypassing
  the standard password change verification process. The issue was fixed in version
  0.56.3.
affected:
- package:
    ecosystem: PyPI
    name: zenml
    purl: pkg:pypi/zenml
  ranges:
  - type: GIT
    events:
    - introduced: "0"
    - fixed: 58cb3d987372c91eb605853c35325701733337c2
    - fixed: 58cb3d987372c91eb605853c35325701733337c2
    repo: https://github.com/zenml-io/zenml
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.56.3
  versions:
  - 0.0.1rc1
  - 0.0.1rc2
  - 0.1.0
  - 0.1.1
  - 0.1.2
  - 0.1.3
  - 0.1.3rc0
  - 0.1.4
  - 0.1.5
  - 0.10.0
  - 0.11.0
  - 0.12.0
  - 0.13.0
  - 0.13.1
  - 0.13.2
  - 0.2.0
  - 0.2.0rc1
  - 0.2.0rc2
  - 0.20.0
  - 0.20.0rc1
  - 0.20.1
  - 0.20.2
  - 0.20.3
  - 0.20.4
  - 0.20.5
  - 0.21.0
  - 0.21.1
  - 0.22.0
  - 0.23.0
  - 0.3.1
  - 0.3.1rc0
  - 0.3.2
  - 0.3.3
  - 0.3.3rc0
  - 0.3.4
  - 0.3.4rc0
  - 0.3.5
  - 0.3.5rc0
  - 0.3.6
  - 0.3.6.1
  - 0.3.6rc0
  - 0.3.7
  - 0.3.7.1rc0
  - 0.3.7.1rc1
  - 0.3.7.1rc3
  - 0.3.7.1rc4
  - 0.3.7rc0
  - 0.3.8
  - 0.3.9rc1
  - 0.3.9rc2
  - 0.30.0
  - 0.30.0rc0
  - 0.30.0rc1
  - 0.30.0rc2
  - 0.30.0rc3
  - 0.31.0
  - 0.31.1
  - 0.32.0
  - 0.32.1
  - 0.33.0
  - 0.34.0
  - 0.35.0
  - 0.35.1
  - 0.36.0
  - 0.36.1
  - 0.37.0
  - 0.38.0
  - 0.39.0
  - 0.39.1
  - 0.40.0
  - 0.40.1
  - 0.40.2
  - 0.40.3
  - 0.41.0
  - 0.42.0
  - 0.42.1
  - 0.42.2
  - 0.43.0
  - 0.43.1
  - 0.44.0
  - 0.44.1
  - 0.44.2
  - 0.44.3
  - 0.44.4
  - 0.45.0
  - 0.45.1
  - 0.45.2
  - 0.45.3
  - 0.45.4
  - 0.45.5
  - 0.45.6
  - 0.46.0
  - 0.46.1
  - 0.47.0
  - 0.5.0
  - 0.5.0rc1
  - 0.5.0rc2
  - 0.5.1
  - 0.5.2
  - 0.5.3
  - 0.5.4
  - 0.5.5
  - 0.5.6
  - 0.5.7
  - 0.50.0
  - 0.51.0
  - 0.52.0
  - 0.53.0
  - 0.53.1
  - 0.54.0
  - 0.54.1
  - 0.55.0
  - 0.55.1
  - 0.55.2
  - 0.55.3
  - 0.55.4
  - 0.55.5
  - 0.56.0
  - 0.56.1
  - 0.56.2
  - 0.6.0
  - 0.6.1
  - 0.6.2
  - 0.6.3
  - 0.7.0
  - 0.7.1
  - 0.7.2
  - 0.7.3
  - 0.8.0
  - 0.8.1
  - 0.8.1rc0
  - 0.9.0
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
references:
- type: EVIDENCE
  url: https://huntr.com/bounties/8f5534ac-fd08-4b8b-8c2e-35949aa36e48
- type: FIX
  url: 
    https://github.com/zenml-io/zenml/commit/58cb3d987372c91eb605853c35325701733337c2
- type: FIX
  url: https://huntr.com/bounties/8f5534ac-fd08-4b8b-8c2e-35949aa36e48
- type: REPORT
  url: https://huntr.com/bounties/8f5534ac-fd08-4b8b-8c2e-35949aa36e48
- type: WEB
  url: https://huntr.com/bounties/8f5534ac-fd08-4b8b-8c2e-35949aa36e48
- type: ADVISORY
  url: https://github.com/advisories/GHSA-j527-v579-m98h