What’s Vulnerable › Vulnerabilities

CVE-2024-2383: Clickjacking Vulnerability in zenml-io/zenml

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-06-06 · updated 2026-06-17
• Weakness: CWE-1021

Description

A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame-Options or Content-Security-Policy HTTP headers. This vulnerability allows an attacker to embed the application UI within an iframe on a malicious page, potentially leading to unauthorized actions by tricking users into interacting with the interface under the attacker's control. The issue was addressed in version 0.56.3.

Affected products

• zenml-io/zenml: before 0.56.3 — fixed in 0.56.3

How to fix

Upgrade to a fixed version: zenml-io/zenml 0.56.3. Check the vendor advisory for mitigations.

References

• https://github.com/zenml-io/zenml/commit/f863fde1269bc355951f8cfc826c0244d88ad5e9
• https://huntr.com/bounties/22d26f5a-c0ae-4344-aa7d-08ff5ada3963
• https://github.com/zenml-io/zenml/commit/f863fde1269bc355951f8cfc826c0244d88ad5e9
• https://huntr.com/bounties/22d26f5a-c0ae-4344-aa7d-08ff5ada3963

Get alerted when CVE-2024-2383 or the next vulnerability affects your stack