PyPi: Zenml

CVE-2024-2260

Safety vulnerability ID: 71955

This vulnerability was reviewed by experts

The information on this page was manually curated by our Cybersecurity Intelligence Team.

Created at Apr 16, 2024 Updated at Nov 12, 2024

Scan your Python projects for vulnerabilities →

Advisory

A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token.

Affected package

zenml

Latest version: 0.70.0

ZenML: Write production-ready ML code.

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

https://huntr.com/bounties/2d0856ec-ed73-477a-8ea2-d5d4f15cf167
https://github.com/zenml-io/zenml/commit/68bcb3ba60cba9729c9713a49c39502d40fb945e
https://github.com/advisories/GHSA-g3r5-72hf-p7p2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2260

Use this package?

Scan your Python project for dependency vulnerabilities in two minutes

Scan your application