CVE-2024-25723
HIGH NUCLEIZenML ZenML Server - Improper Authentication
Title source: nucleiExploitation Summary
EIP tracks 1 public exploit for CVE-2024-25723. PoCs published by david-botelho-mariano. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a working PoC for CVE-2024-25723, an authentication bypass vulnerability in ZenML. The exploit allows an attacker to reset the password of any user account by leveraging an insecure API endpoint.
Description
ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2.
Exploits (1)
This repository contains a working PoC for CVE-2024-25723, an authentication bypass vulnerability in ZenML. The exploit allows an attacker to reset the password of any user account by leveraging an insecure API endpoint.
Nuclei Templates (1)
http.favicon.hash:-2028554187
body="ZenML"
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H