CVE-2024-25723

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-25723
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-25723.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-25723
Aliases
Published
2024-02-27T15:15:07.757Z
Modified
2026-04-10T05:43:04.316909Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{usernameor_id}/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2.

References

Affected packages

Git / github.com/zenml-io/zenml

Affected ranges

Type
GIT
Repo
https://github.com/zenml-io/zenml
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
fe85ae4c822c71a8d4720ed1440e21f3257c85fa
Introduced
0c792d895962b5c25da707ea7989661338dc7843
Fixed
6123cb2edf5fb4e9dd61f081c1abd52415111535
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
97c0667949bcb8b3dc0b4e1a615558770ece8c90
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.42.2"
        },
        {
            "introduced": "0.44.0"
        },
        {
            "fixed": "0.44.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.43.0"
        }
    ]
}

Affected versions

0.*
0.1.0
0.1.1
0.1.2
0.1.3
0.1.3rc0
0.10.0
0.11.0
0.12.0
0.13.0
0.13.1
0.13.2
0.2.0
0.2.0rc1
0.2.0rc2
0.20.3
0.20.5
0.21.0
0.21.1
0.22.0
0.23.0
0.3.0
0.3.1
0.3.1rc0
0.3.2
0.3.3
0.3.3rc0
0.3.4
0.3.4rc0
0.3.5
0.3.5rc0
0.3.6
0.3.6.1
0.3.6rc0
0.3.7
0.3.7.1rc0
0.3.7.1rc1
0.3.7.1rc2
0.3.7.1rc3
0.3.7.1rc4
0.3.7.1rc5
0.3.7rc0
0.3.8
0.3.9rc1
0.3.9rc2
0.30.0
0.31.0
0.31.1
0.32.0
0.32.1
0.33.0
0.34.0
0.35.0
0.35.1
0.36.1
0.37.0
0.38.0
0.39.0
0.39.1
0.40.0
0.40.1
0.40.2
0.41.0
0.42.0
0.42.1
0.43.0
0.44.0
0.44.1
0.44.2
0.44.3
0.5.0
0.5.0rc1
0.5.0rc2
0.5.1
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.6.2
0.6.3
0.7.0
0.7.1
0.8.1
0.8.1rc0
0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-25723.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0.45.0"
            },
            {
                "fixed": "0.46.7"
            }
        ]
    }
]