CVE-2024-2213
Improper Authentication in zenml-io/zenml
An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized account takeover by bypassing the standard password change verification process. The issue was fixed in version 0.56.3.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper Authentication in zenml-io/zenml
An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized account takeover by bypassing the standard password change verification process. The issue was fixed in version 0.56.3.
- Record
CVE-2024-2213- CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-620
- Updated
- 2026-11-02
EUVDEUVD-2024-0197
An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized account takeover by bypassing the standard password change verification process. The issue was fixed in version 0.56.3.
- Record
EUVD-2024-0197- CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j527-v579-m98h
Improper authentication in zenml
An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized account takeover by bypassing the standard password change verification process. The issue was fixed in version 0.56.3.
- Record
GHSA-j527-v579-m98h- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-287, CWE-620
- Updated
- 2026-11-02
NVD
An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized account takeover by bypassing the standard password change verification process. The issue was fixed in version 0.56.3.
- Record
CVE-2024-2213- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-620
- Updated
- 2026-11-02
OSV
Improper Authentication in zenml-io/zenml
An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized account takeover by bypassing the standard password change verification process. The issue was fixed in version 0.56.3.
- Record
CVE-2024-2213- CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-620
- Updated
- 2026-11-02
OSVGHSA-j527-v579-m98h
Improper authentication in zenml
An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized account takeover by bypassing the standard password change verification process. The issue was fixed in version 0.56.3.
- Record
GHSA-j527-v579-m98h- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-287, CWE-620
- Updated
- 2026-11-02
OSVPYSEC-2024-193
An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized account takeover by bypassing the standard password change verification process. The issue was fixed in version 0.56.3.
- Record
PYSEC-2024-193- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zenmlPyPI |
before 0.56.3 | 0.56.3 |
zenmlPyPI |
before 0.56.3, plus listed versions 0.0.1rc10.0.1rc20.1.00.1.10.1.2 Show 45 moreShow less0.1.30.1.3rc00.1.40.1.50.10.00.11.00.12.00.13.00.13.10.13.20.2.00.2.0rc10.2.0rc20.20.00.20.0rc10.20.10.20.20.20.30.20.40.20.50.21.00.21.10.22.00.23.00.3.10.3.1rc00.3.20.3.30.3.3rc00.3.40.3.4rc00.3.50.3.5rc00.3.60.3.6.10.3.6rc00.3.70.3.7.1rc00.3.7.1rc10.3.7.1rc30.3.7.1rc40.3.7rc00.3.80.3.9rc10.3.9rc2 |
0.56.3 |
zenmlPyPI |
before 0.56.3, plus listed versions 0.0.1rc10.0.1rc20.1.00.1.10.1.2 Show 45 moreShow less0.1.30.1.3rc00.1.40.1.50.10.00.11.00.12.00.13.00.13.10.13.20.2.00.2.0rc10.2.0rc20.20.00.20.0rc10.20.10.20.20.20.30.20.40.20.50.21.00.21.10.22.00.23.00.3.10.3.1rc00.3.20.3.30.3.3rc00.3.40.3.4rc00.3.50.3.5rc00.3.60.3.6.10.3.6rc00.3.70.3.7.1rc00.3.7.1rc10.3.7.1rc30.3.7.1rc40.3.7rc00.3.80.3.9rc10.3.9rc2 |
0.56.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-2213 is a low vulnerability (CVSS 3.3) in Zenml, published June 6, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in zenml 0.56.3.
References
huntr.com/bounties/8f5534ac-fd08-4b8b-8c2e-35949aa36e48
github.com/zenml-io/zenml/commit/58cb3d987372c91eb605853c35325701733337c2
nvd.nist.gov/vuln/detail/CVE-2024-2213
Left out here: 167 versions. The JSON record has them.