Remote Privilege Escalation in ZenML Server for Machine Learning Package

CVE-2024-25723

What is CVE-2024-25723?

The ZenML Server, part of the ZenML machine learning framework, exhibits a remote privilege escalation vulnerability due to improper access control on the /api/v1/users/{user_name_or_id}/activate endpoint. This flaw allows unauthorized users with a valid username to activate accounts simply by providing a new password. As a result, attackers could potentially gain elevated permissions within the system. This issue impacts versions before 0.46.7, with specific patches available in versions 0.44.4, 0.43.1, and 0.42.2.

References