GHSA-9x88-4jg8-4vf7

Improper authorization in zenml

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-2035

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	zenml	< 0.56.2	0.56.2

Details

As written in the advisory (Markdown source, shown as plain text).

An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the `active` status of user accounts to false, effectively deactivating them. This issue affects version 0.55.3 and was fixed in version 0.56.2. The impact of this vulnerability is significant as it allows for the deactivation of admin accounts, potentially disrupting the functionality and security of the application.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-2035 advisory
https://github.com/zenml-io/zenml/commit/b95f083efffa56831cd41d8ed536aeb0b6038fa3 web
https://github.com/pypa/advisory-database/tree/main/vulns/zenml/PYSEC-2024-169.yaml web
https://github.com/zenml-io/zenml package
https://huntr.com/bounties/1cfc6493-082e-4229-9f2f-496801a6557c web