CVE-2024-2035 json
Improper Authorization in zenml-io/zenml
published 2024-06-06 2 y ago modified 2026-06-17 4 mo ago also GHSA-9x88-4jg8-4vf7 , PYSEC-2024-169 , EUVD-2024-0194
- cvss
- 6.5
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 50%
- public exploits
- 0
- none known
Summary
An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the `active` status of user accounts to false, effectively deactivating them. This issue affects version 0.55.3 and was fixed in version 0.56.2. The impact of this vulnerability is significant as it allows for the deactivation of admin accounts, potentially disrupting the functionality and security of the application.
Patch / fix
- pypi zenml 0.56.2
- zenml-io zenml-io/zenml 0.56.2
- zenmlio zenml 0.56.2
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.62% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/1cfc6493-082e-4229-9f2f-496801a6557c referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H |
| GitHub | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | zenml | <0.56.2 |
0.56.2 |
Affected products
- zenml-io zenml-io/zenml
- zenmlio zenml
Classification
References
-
github.com
/zenml-io/zenml/commit/b95f083efffa56831cd41d8ed536aeb0b6038fa3
web, patch
-
huntr.com
/bounties/1cfc6493-082e-4229-9f2f-496801a6557c
web, exploit, issue-tracking, patch, third-party-advisory, evidence, report
-
nvd.nist.gov
/vuln/detail/CVE-2024-2035
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/zenml/PYSEC-2024-169.yaml
web
-
github.com
/zenml-io/zenml
package
-
github.com
/advisories/GHSA-9x88-4jg8-4vf7
advisory
Sources
- CVE List CVE-2024-2035
- GitHub Advisory GHSA-9x88-4jg8-4vf7
- NVD CVE-2024-2035
- OSV PYSEC-2024-169
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.