2 lines
3.4 KiB
JSON
2 lines
3.4 KiB
JSON
{"affected":[{"affectedData":[{"product":"zenml-io/zenml","vendor":"zenml-io","versions":[{"lessThan":"0.56.2","status":"affected","version":"unspecified","versionType":"custom"}]}],"source":"security@huntr.dev"},{"affectedData":[{"cpes":["cpe:2.3:a:zenmlio:zenml:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"zenml","vendor":"zenmlio","versions":[{"lessThan":"0.56.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:zenml:zenml:*:*:*:*:*:*:*:*","matchCriteriaId":"B39C79D8-E418-4820-A799-CE4633861C93","versionEndExcluding":"0.56.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token."},{"lang":"es","value":"Existe una vulnerabilidad de reparación de sesión en la aplicación zenml-io/zenml, donde los tokens JWT utilizados para la autenticación del usuario no se invalidan al cerrar sesión. Esta falla permite a un atacante eludir los mecanismos de autenticación reutilizando el token JWT de la víctima."}],"id":"CVE-2024-2260","lastModified":"2026-06-17T07:24:10.190","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.0"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"security@huntr.dev","type":"Secondary"}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-2260","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-07-03T17:33:53.794175Z","version":"2.0.3"}}]},"published":"2024-04-16T00:15:11.237","references":[{"source":"security@huntr.dev","tags":["Patch"],"url":"https://github.com/zenml-io/zenml/commit/68bcb3ba60cba9729c9713a49c39502d40fb945e"},{"source":"security@huntr.dev","tags":["Exploit","Third Party Advisory"],"url":"https://huntr.com/bounties/2d0856ec-ed73-477a-8ea2-d5d4f15cf167"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"url":"https://github.com/zenml-io/zenml/commit/68bcb3ba60cba9729c9713a49c39502d40fb945e"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://huntr.com/bounties/2d0856ec-ed73-477a-8ea2-d5d4f15cf167"}],"sourceIdentifier":"security@huntr.dev","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-384"}],"source":"security@huntr.dev","type":"Secondary"}]}
|