~ / search / GHSA-vf7j-cmrj-pmmm

GHSA-vf7j-cmrj-pmmm

ZenML Server Remote Privilege Escalation Vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-25723

Packages

EcosystemPackageAffectedFixed in
PyPI zenml < 0.42.2 0.42.2
PyPI zenml >= 0.43.0, < 0.43.1 0.43.1
PyPI zenml >= 0.45.0, < 0.46.7 0.46.7
PyPI zenml >= 0.44.0, < 0.44.4 0.44.4

Details

As written in the advisory (Markdown source, shown as plain text).

ZenML Server in the ZenML package before 0.46.7 for Python allows remote privilege escalation because the `/api/v1/users/{user_name_or_id}/activate` REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2.

References

External links from the advisory. They lead to third-party sites.