CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2024-25723
High (8.8) in zenml zenml. EPSS 71% chance of exploitation in the next 30 days. Fixed in zenml 0.42.2, 0.43.1, 0.44.4.
ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2.
Severity
- EPSS
- 71% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWE
- CWE-284
- Published
- Modified
- Record from
- the NVD, synced
Affected
- zenml:zenml
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vf7j-cmrj-pmmm | PyPI | zenml | <0.42.2 | 0.42.2 |
| GHSA-vf7j-cmrj-pmmm | PyPI | zenml | >=0.43.0 <0.43.1 | 0.43.1 |
| GHSA-vf7j-cmrj-pmmm | PyPI | zenml | >=0.45.0 <0.46.7 | 0.46.7 |
| GHSA-vf7j-cmrj-pmmm | PyPI | zenml | >=0.44.0 <0.44.4 | 0.44.4 |
| PYSEC-2026-2072 | PyPI | zenml | <0.42.2 >=0.43.0 <0.43.1 >=0.44.0 <0.44.4 >=0.45.0 <0.46.7 | 0.42.2, 0.43.1, 0.44.4, 0.46.7 |