CVE-2024-2171

published 2024-06-06

CVE-2024-2171: A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logo_url' field. By injecting…

Priority P4 20 medium 4.8 CVSS 3.1

AV N AC L PR H UI R S C C L I L A N

A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logo_url' field. By injecting malicious payloads into this field, an attacker could send harmful messages to other users, potentially compromising their accounts. The vulnerability affects version 0.55.3 and was fixed in version 0.56.2. The impact of exploiting this vulnerability could lead to user account compromise.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
zenml-io	zenml-io_zenml	>= unspecified < 0.56.2	0.56.2
zenml	zenml	< 0.56.2	0.56.2
zenml	zenml	< 68bcb3ba60cba9729c9713a49c39502d40fb945e	68bcb3ba60cba9729c9713a49c39502d40fb945e
zenml	zenml	>= 0 < 0.56.2	0.56.2
zenml	zenml	>= 0 < 68bcb3ba60cba9729c9713a49c39502d40fb945e	68bcb3ba60cba9729c9713a49c39502d40fb945e

CVSS provenance

nvd v3.1 4.8 MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

nvd v3.0 3.4 LOW CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79