Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-99hm-86h7-gr3g

Опубликовано: 08 июн. 2024
Источник: github
Github: Прошло ревью
CVSS4: 2
CVSS3: 3.9

Описание

zenml-io/zenml does not expire the session after password reset

A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access to a compromised account without the victim's ability to revoke this access. This issue was observed in a self-hosted ZenML deployment via Docker, where after changing the password from one browser, the session remained active and usable in another browser without requiring re-authentication.

Пакеты

Наименование

zenml

pip
Затронутые версииВерсия исправления

<= 0.56.3

Отсутствует

EPSS

Процентиль: 22%
0.00073
Низкий

2 Low

CVSS4

3.9 Low

CVSS3

Дефекты

CWE-613

Связанные уязвимости

CVSS3: 8.8
nvd
больше 1 года назад

A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access to a compromised account without the victim's ability to revoke this access. This issue was observed in a self-hosted ZenML deployment via Docker, where after changing the password from one browser, the session remained active and usable in another browser without requiring re-authentication.

CVSS3: 3.9
fstec
больше 1 года назад

Уязвимость фреймворка создания конвейеров машинного обучения Zenml, связанная с неверным сроком действия сеанса, позволяющая нарушителю обойти процесс аутентификации

EPSS

Процентиль: 22%
0.00073
Низкий

2 Low

CVSS4

3.9 Low

CVSS3

Дефекты

CWE-613