CVE-2024-2171 Stored XSS in zenml-io/zenml
Attackers can inject malicious scripts via the logo_url field to compromise other users' accounts in the ZenML platform.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-2171?
CVE-2024-2171 is a low-severity cross-site scripting vulnerability in zenml-io/zenml, published on 6 Jun 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logo_url' field. By injecting malicious payloads into this field, an attacker could send harmful messages to other users, potentially compromising their accounts. The vulnerability affects version 0.55.3 and was fixed in version 0.56.2. The impact of exploiting this vulnerability could lead to user account compromise.
Weakness: CWE-79
Which versions are affected by CVE-2024-2171?
3 open source packages ship an affected version, including zenml. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
zenml PyPI | All versions | 0.56.2 |
zenml PyPI | All versions | 0.56.2 |
zenml PyPI | All versions | 0.56.2 |
Products include Zenml Zenml.
How do I fix CVE-2024-2171?
Upgrade zenml to 0.56.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-2171 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-2171 exists.
Other vulnerabilities in zenml-io/zenml
Sources
Also known as GHSA-vwgf-7f9h-h499, PYSEC-2024-170.