zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to take over the user's account. This vulnerability is due to the absence of rate-limiting on the '/api/v1/current-user' endpoint, which does not restrict the number of attempts an attacker can make to guess the current password. Successful exploitation results in the attacker being able to change the password and take control of the account.

According to its banner, the version of ZenML running on the remote host is < 0.57.0. It is, therefore, affected by an Account Takeover due to the lack of rate-limiting in the password change function.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the
    password change function. An attacker can brute-force the current password in the 'Update Password'
    function, allowing them to take over the user's account. This vulnerability is due to the absence of rate-
    limiting on the '/api/v1/current-user' endpoint, which does not restrict the number of attempts an
    attacker can make to guess the current password. Successful exploitation results in the attacker being
    able to change the password and take control of the account. (CVE-2024-4311)

The version of ZenML installed on the remote host is prior to 0.57.0. It is, therefore, affected by an account takeover exposure due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to take over the user's account. This vulnerability is due to the absence of rate-limiting on the '/api/v1/current-user' endpoint, which does not restrict the number of attempts an attacker can make to guess the current password. Successful exploitation results in the attacker being able to change the password and take control of the account.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114936	ZenML < 0.57.0 Account Takeover	Web App Scanning	Artificial Intelligence	medium
416107	SCA: security update for zenml (GHSA-j3vq-pmp5-r5xj)	Tenable Cloud Security	SCA Checks	medium
416107	SCA: security update for zenml (GHSA-j3vq-pmp5-r5xj)	Tenable Self-Hosted Container Security	SCA Checks	medium
213484	ZenML < 0.57.0 Password Reset Brute Force (CVE-2024-4311)	Nessus	Artificial Intelligence	medium

Detections

Analytics

CVE-2024-4311

medium

Tenable Plugins

medium

medium

medium

medium