CVE-2024-25723
- Source
- https://cve.org/CVERecord?id=CVE-2024-25723
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-25723.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-25723
- Aliases
- Published
- 2024-02-27T00:00:00Z
- Modified
- 2026-08-12T03:51:45.599374448Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{usernameor_id}/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25723.json", "cna_assigner": "mitre", "unresolved_ranges": [ { "extracted_events": [ { "fixed": "0.46.7" } ], "source": "DESCRIPTION" } ] }- References
-
- https://github.com/zenml-io/zenml/compare/0.42.1...0.42.2
- https://github.com/zenml-io/zenml/compare/0.43.0...0.43.1
- https://github.com/zenml-io/zenml/compare/0.44.3...0.44.4
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25723.json
- https://nvd.nist.gov/vuln/detail/CVE-2024-25723
- https://github.com/zenml-io/zenml
- https://www.zenml.io/blog/critical-security-update-for-zenml-users
Affected packages
Git / github.com/zenml-io/zenml
Affected ranges
- Type
- GIT
- Repo
- https://github.com/zenml-io/zenml
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedIntroducedLast affected
- Database specific
-
Show details
{ "cpe": [ "cpe:2.3:a:zenml:zenml:*:*:*:*:*:*:*:*", "cpe:2.3:a:zenml:zenml:0.43.0:*:*:*:*:*:*:*" ], "source": [ "CPE_RANGE", "CPE_STRING" ], "extracted_events": [ { "introduced": "0" }, { "fixed": "0.42.2" }, { "introduced": "0.44.0" }, { "fixed": "0.44.4" }, { "introduced": "0.43.0" }, { "last_affected": "0.43.0" } ] }
Affected versions
0.*
0.1.0
0.1.1
0.1.2
0.1.3
0.1.3rc0
0.10.0
0.11.0
0.12.0
0.13.0
0.13.1
0.13.2
0.2.0
0.2.0rc1
0.2.0rc2
0.20.3
0.20.5
0.21.0
0.21.1
0.22.0
0.23.0
0.3.0
0.3.1
0.3.1rc0
0.3.2
0.3.3
0.3.3rc0
0.3.4
0.3.4rc0
0.3.5
0.3.5rc0
0.3.6
0.3.6.1
0.3.6rc0
0.3.7
0.3.7.1rc0
0.3.7.1rc1
0.3.7.1rc2
0.3.7.1rc3
0.3.7.1rc4
0.3.7.1rc5
0.3.7rc0
0.3.8
0.3.9rc1
0.3.9rc2
0.30.0
0.31.0
0.31.1
0.32.0
0.32.1
0.33.0
0.34.0
0.35.0
0.35.1
0.36.1
0.37.0
0.38.0
0.39.0
0.39.1
0.40.0
0.40.1
0.40.2
0.41.0
0.42.0
0.42.1
0.43.0
0.44.0
0.44.1
0.44.2
0.44.3
0.5.0
0.5.0rc1
0.5.0rc2
0.5.1
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.6.2
0.6.3
0.7.0
0.7.1
0.8.1
0.8.1rc0
0.9.0