Session Reuse Vulnerability in ZenML Allows for Unauthorized Access

CVE-2024-4680

What is CVE-2024-4680?

A vulnerability exists in ZenML, specifically the version 0.56.3, which allows attackers to exploit insufficient session expiration mechanisms. This flaw enables the reuse of old session credentials or session IDs when a password is changed. For instance, users who update their passwords find that their session may remain active across different browsers, creating an avenue for unauthorized access. This issue is particularly concerning in self-hosted ZenML deployments via Docker, where an attacker could maintain access to a compromised account without the ability for the victim to terminate that session, thereby undermining account security and user trust.

References