CVE-2024-2035 Improper Authorization in zenml-io/zenml
Authenticated users can modify other users' data, including deactivating admin accounts, disrupting application functionality.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-2035?
CVE-2024-2035 is a medium-severity missing authorization vulnerability in zenml-io/zenml, published on 6 Jun 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the `active` status of user accounts to false, effectively deactivating them. This issue affects version 0.55.3 and was fixed in version 0.56.2. The impact of this vulnerability is significant as it allows for the deactivation of admin accounts, potentially disrupting the functionality and security of the application.
Weakness: CWE-862
Which versions are affected by CVE-2024-2035?
3 open source packages ship an affected version, including zenml. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
zenml PyPI | All versions | 0.56.2 |
zenml PyPI | All versions | 0.56.2 |
zenml PyPI | All versions | 0.56.2 |
Products include Zenml Zenml.
How do I fix CVE-2024-2035?
Upgrade zenml to 0.56.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-2035 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-2035 exists.
Other vulnerabilities in zenml-io/zenml
Sources
Also known as GHSA-9x88-4jg8-4vf7, PYSEC-2024-169.