What’s Vulnerable › Vulnerabilities

CVE-2024-2213: Improper Authentication in zenml-io/zenml

• Severity: low (CVSS 3.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-06-06 · updated 2026-06-17
• Weakness: CWE-620

Description

An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized account takeover by bypassing the standard password change verification process. The issue was fixed in version 0.56.3.

Affected products

• zenml-io/zenml: before 0.56.3 — fixed in 0.56.3

How to fix

Upgrade to a fixed version: zenml-io/zenml 0.56.3. Check the vendor advisory for mitigations.

References

• https://github.com/zenml-io/zenml/commit/58cb3d987372c91eb605853c35325701733337c2
• https://huntr.com/bounties/8f5534ac-fd08-4b8b-8c2e-35949aa36e48
• https://github.com/zenml-io/zenml/commit/58cb3d987372c91eb605853c35325701733337c2
• https://huntr.com/bounties/8f5534ac-fd08-4b8b-8c2e-35949aa36e48

Get alerted when CVE-2024-2213 or the next vulnerability affects your stack