CVE-2024-2032
published 2024-06-06CVE-2024-2032: A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same…
PriorityP410low3.1CVSS 3.1
AVNACHPRHUIRSUCNILAL
EPSS
0.29%
20.5th percentile
A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to insufficient handling of concurrent user creation requests, leading to data inconsistencies and potential authentication problems. Specifically, concurrent processes may overwrite or corrupt user data, complicating user identification and posing security risks. This issue is particularly concerning for APIs that rely on usernames as input parameters, such as PUT /api/v1/users/test_race, where it could lead to further complications.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zenml-io | zenml-io_zenml | >= unspecified < 0.55.5 | 0.55.5 |
| zenml | zenml | < 0.55.5 | 0.55.5 |
| zenml | zenml | >= 0 < afcaf741ef9114c9b32f722f101b97de3d8d147b | afcaf741ef9114c9b32f722f101b97de3d8d147b |
| zenml | zenml | >= 0 < 0.55.5 | 0.55.5 |
CVSS provenance
nvdv3.13.1LOWCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L
nvdv3.03.1LOWCVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2024-2032: A race condition vulnerability exists in zenml-io/zenml versions up to and including 0
osv·2024-06-06
CVE-2024-2032 CVE-2024-2032: A race condition vulnerability exists in zenml-io/zenml versions up to and including 0
A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to insufficient handling of concurrent user creation requests, leading to data inconsistencies and potential authentication problems. Specifically, concurrent processes may overwrite or corrupt user data, complicating user identification and posing security risks. This issue is particularly concerning for APIs that rely on usernames as input parameters, such as PUT /api/v1/users/test_race, where it could lead to further complications.
OSV
Race condition in zenml
osv·2024-06-06
CVE-2024-2032 [LOW] Race condition in zenml
Race condition in zenml
A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to insufficient handling of concurrent user creation requests, leading to data inconsistencies and potential authentication problems. Specifically, concurrent processes may overwrite or corrupt user data, complicating user identification and posing security risks. This issue is particularly concerning for APIs that rely on usernames as input parameters, such as PUT /api/v1/users/test_race, where it could lead to further complications.
GHSA
Race condition in zenml
ghsa·2024-06-06
CVE-2024-2032 [LOW] CWE-362 Race condition in zenml
Race condition in zenml
A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to insufficient handling of concurrent user creation requests, leading to data inconsistencies and potential authentication problems. Specifically, concurrent processes may overwrite or corrupt user data, complicating user identification and posing security risks. This issue is particularly concerning for APIs that rely on usernames as input parameters, such as PUT /api/v1/users/test_race, where it could lead to further complications.
No detection rules found.
No public exploits indexed.
2024-06-06
Published