CVE-2024-4311

Katalog CVE

CVSS 5.4 · Medium EPSS 0,48%

Kerentanan Allocation of Resources Without Limits or Throttling pada zenml. Skor CVSS 3.1 5.4 (Medium) menurut CISA ADP.

Deskripsi (NVD)

zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to take over the user's account. This vulnerability is due to the absence of rate-limiting on the '/api/v1/current-user' endpoint, which does not restrict the number of attempts an attacker can make to guess the current password. Successful exploitation results in the attacker being able to change the password and take control of the account.

Rincian

Terbit di NVD

14 November 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/zenml-io/zenml/commit/87a6c2c8f45b49ea83fbb5fe8fff7ab5365a60c9 patch
• https://huntr.com/bounties/d5517e1a-6b94-4e38-aad6-3aa65f98bec2 exploit · advisory pihak ketiga