cbcvebase.
CVE-2024-2035
published 2024-06-06

CVE-2024-2035: An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability…

PriorityP335medium6.5CVSS 3.1
AVNACLPRHUINSUCNIHAH
EPSS
0.62%
45.3th percentile
An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the `active` status of user accounts to false, effectively deactivating them. This issue affects version 0.55.3 and was fixed in version 0.56.2. The impact of this vulnerability is significant as it allows for the deactivation of admin accounts, potentially disrupting the functionality and security of the application.

Affected

5 ranges
VendorProductVersion rangeFixed in
zenml-iozenml-io_zenml>= unspecified < 0.56.20.56.2
zenmlzenml< 0.56.20.56.2
zenmlzenml< b95f083efffa56831cd41d8ed536aeb0b6038fa3b95f083efffa56831cd41d8ed536aeb0b6038fa3
zenmlzenml>= 0 < 0.56.20.56.2
zenmlzenml>= 0 < b95f083efffa56831cd41d8ed536aeb0b6038fa3b95f083efffa56831cd41d8ed536aeb0b6038fa3

CVSS provenance

nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.