id: PYSEC-2024-194
modified: 2025-01-19T13:22:31.835293Z
published: 2024-06-06T19:15:54Z
aliases:
- CVE-2024-2383
- GHSA-mq73-g4qr-fgcq
details: A clickjacking vulnerability exists in zenml-io/zenml versions up to and
  including 0.55.5 due to the application's failure to set appropriate X-Frame-Options
  or Content-Security-Policy HTTP headers. This vulnerability allows an attacker to
  embed the application UI within an iframe on a malicious page, potentially leading
  to unauthorized actions by tricking users into interacting with the interface under
  the attacker's control. The issue was addressed in version 0.56.3.
affected:
- package:
    ecosystem: PyPI
    name: zenml
    purl: pkg:pypi/zenml
  ranges:
  - type: GIT
    events:
    - introduced: "0"
    - fixed: f863fde1269bc355951f8cfc826c0244d88ad5e9
    - fixed: f863fde1269bc355951f8cfc826c0244d88ad5e9
    repo: https://github.com/zenml-io/zenml
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.56.3
  versions:
  - 0.0.1rc1
  - 0.0.1rc2
  - 0.1.0
  - 0.1.1
  - 0.1.2
  - 0.1.3
  - 0.1.3rc0
  - 0.1.4
  - 0.1.5
  - 0.10.0
  - 0.11.0
  - 0.12.0
  - 0.13.0
  - 0.13.1
  - 0.13.2
  - 0.2.0
  - 0.2.0rc1
  - 0.2.0rc2
  - 0.20.0
  - 0.20.0rc1
  - 0.20.1
  - 0.20.2
  - 0.20.3
  - 0.20.4
  - 0.20.5
  - 0.21.0
  - 0.21.1
  - 0.22.0
  - 0.23.0
  - 0.3.1
  - 0.3.1rc0
  - 0.3.2
  - 0.3.3
  - 0.3.3rc0
  - 0.3.4
  - 0.3.4rc0
  - 0.3.5
  - 0.3.5rc0
  - 0.3.6
  - 0.3.6.1
  - 0.3.6rc0
  - 0.3.7
  - 0.3.7.1rc0
  - 0.3.7.1rc1
  - 0.3.7.1rc3
  - 0.3.7.1rc4
  - 0.3.7rc0
  - 0.3.8
  - 0.3.9rc1
  - 0.3.9rc2
  - 0.30.0
  - 0.30.0rc0
  - 0.30.0rc1
  - 0.30.0rc2
  - 0.30.0rc3
  - 0.31.0
  - 0.31.1
  - 0.32.0
  - 0.32.1
  - 0.33.0
  - 0.34.0
  - 0.35.0
  - 0.35.1
  - 0.36.0
  - 0.36.1
  - 0.37.0
  - 0.38.0
  - 0.39.0
  - 0.39.1
  - 0.40.0
  - 0.40.1
  - 0.40.2
  - 0.40.3
  - 0.41.0
  - 0.42.0
  - 0.42.1
  - 0.42.2
  - 0.43.0
  - 0.43.1
  - 0.44.0
  - 0.44.1
  - 0.44.2
  - 0.44.3
  - 0.44.4
  - 0.45.0
  - 0.45.1
  - 0.45.2
  - 0.45.3
  - 0.45.4
  - 0.45.5
  - 0.45.6
  - 0.46.0
  - 0.46.1
  - 0.47.0
  - 0.5.0
  - 0.5.0rc1
  - 0.5.0rc2
  - 0.5.1
  - 0.5.2
  - 0.5.3
  - 0.5.4
  - 0.5.5
  - 0.5.6
  - 0.5.7
  - 0.50.0
  - 0.51.0
  - 0.52.0
  - 0.53.0
  - 0.53.1
  - 0.54.0
  - 0.54.1
  - 0.55.0
  - 0.55.1
  - 0.55.2
  - 0.55.3
  - 0.55.4
  - 0.55.5
  - 0.56.0
  - 0.56.1
  - 0.56.2
  - 0.6.0
  - 0.6.1
  - 0.6.2
  - 0.6.3
  - 0.7.0
  - 0.7.1
  - 0.7.2
  - 0.7.3
  - 0.8.0
  - 0.8.1
  - 0.8.1rc0
  - 0.9.0
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
references:
- type: EVIDENCE
  url: https://huntr.com/bounties/22d26f5a-c0ae-4344-aa7d-08ff5ada3963
- type: FIX
  url: 
    https://github.com/zenml-io/zenml/commit/f863fde1269bc355951f8cfc826c0244d88ad5e9
- type: FIX
  url: https://huntr.com/bounties/22d26f5a-c0ae-4344-aa7d-08ff5ada3963
- type: REPORT
  url: https://huntr.com/bounties/22d26f5a-c0ae-4344-aa7d-08ff5ada3963
- type: WEB
  url: https://huntr.com/bounties/22d26f5a-c0ae-4344-aa7d-08ff5ada3963
- type: ADVISORY
  url: https://github.com/advisories/GHSA-mq73-g4qr-fgcq