GHSA-vf7j-cmrj-pmmm

Suggest an improvement
Source
https://github.com/advisories/GHSA-vf7j-cmrj-pmmm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-vf7j-cmrj-pmmm/GHSA-vf7j-cmrj-pmmm.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-vf7j-cmrj-pmmm
Aliases
Published
2024-02-27T15:30:33Z
Modified
2026-07-07T17:57:10.180545160Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
ZenML Server Remote Privilege Escalation Vulnerability
Details

ZenML Server in the ZenML package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2.

Database specific 
{
    "github_reviewed_at": "2024-02-27T21:54:56Z",
    "nvd_published_at": "2024-02-27T15:15:07Z",
    "cwe_ids": [
        "CWE-284"
    ],
    "severity": "HIGH",
    "github_reviewed": true
}
References

Affected packages

PyPI / zenml

Package

Name
zenml
View open source insights on deps.dev
Purl
pkg:pypi/zenml

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.42.2

Affected versions

0.*
0.0.1rc1
0.0.1rc2
0.1.0
0.1.1
0.1.2
0.1.3rc0
0.1.3
0.1.4
0.1.5
0.2.0rc1
0.2.0rc2
0.2.0
0.3.1rc0
0.3.1
0.3.2
0.3.3rc0
0.3.3
0.3.4rc0
0.3.4
0.3.5rc0
0.3.5
0.3.6rc0
0.3.6
0.3.6.1
0.3.7rc0
0.3.7
0.3.7.1rc0
0.3.7.1rc1
0.3.7.1rc3
0.3.7.1rc4
0.3.8
0.3.9rc1
0.3.9rc2
0.5.0rc1
0.5.0rc2
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.6.0
0.6.1
0.6.2
0.6.3
0.7.0
0.7.1
0.7.2
0.7.3
0.8.0
0.8.1rc0
0.8.1
0.9.0
0.10.0
0.11.0
0.12.0
0.13.0
0.13.1
0.13.2
0.20.0rc1
0.20.0
0.20.1
0.20.2
0.20.3
0.20.4
0.20.5
0.21.0
0.21.1
0.22.0
0.23.0
0.30.0rc0
0.30.0rc1
0.30.0rc2
0.30.0rc3
0.30.0
0.31.0
0.31.1
0.32.0
0.32.1
0.33.0
0.34.0
0.35.0
0.35.1
0.36.0
0.36.1
0.37.0
0.38.0
0.39.0
0.39.1
0.40.0
0.40.1
0.40.2
0.40.3
0.41.0
0.42.0
0.42.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-vf7j-cmrj-pmmm/GHSA-vf7j-cmrj-pmmm.json"

PyPI / zenml

Package

Name
zenml
View open source insights on deps.dev
Purl
pkg:pypi/zenml

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.43.0
Fixed
0.43.1

Affected versions

0.*
0.43.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-vf7j-cmrj-pmmm/GHSA-vf7j-cmrj-pmmm.json"

PyPI / zenml

Package

Name
zenml
View open source insights on deps.dev
Purl
pkg:pypi/zenml

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.45.0
Fixed
0.46.7

Affected versions

0.*
0.45.0
0.45.1
0.45.2
0.45.3
0.45.4
0.45.5
0.45.6
0.46.0
0.46.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-vf7j-cmrj-pmmm/GHSA-vf7j-cmrj-pmmm.json"

PyPI / zenml

Package

Name
zenml
View open source insights on deps.dev
Purl
pkg:pypi/zenml

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.44.0
Fixed
0.44.4

Affected versions

0.*
0.44.0
0.44.1
0.44.2
0.44.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-vf7j-cmrj-pmmm/GHSA-vf7j-cmrj-pmmm.json"