Skip to content

zenml Session Fixation vulnerability

Moderate severity GitHub Reviewed Published Apr 16, 2024 to the GitHub Advisory Database • Updated Apr 16, 2024

Package

pip zenml (pip)

Affected versions

< 0.56.2

Patched versions

0.56.2

Description

A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token.

References

Published by the National Vulnerability Database Apr 16, 2024
Published to the GitHub Advisory Database Apr 16, 2024
Reviewed Apr 16, 2024
Last updated Apr 16, 2024

Severity

Moderate
4.2
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS score

0.043%
(10th percentile)

Weaknesses

CVE ID

CVE-2024-2260

GHSA ID

GHSA-g3r5-72hf-p7p2

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.