CVE-2024-25723

描述

ZenML Server in the ZenML package before 0.46.7 for Python allows remote privilege escalation because the `/api/v1/users/{user_name_or_id}/activate` REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2.

如何修補 CVE-2024-25723

要修補 CVE-2024-25723,請將受影響套件升級到下列已修補版本。

• —升級至 0.42.2 或更新版本
• —升級至 0.42.2 或更新版本

CVE-2024-25723 正在被利用嗎?

可能 — EPSS 為 70.6%,屬於高被利用機率區間,建議優先修補。

受影響套件(2)

• from 0, < 0.42.2
• from 0, < 0.42.2, >= 0.43.0, < 0.43.1, >= 0.44.0, < 0.44.4, >= 0.45.0, < 0.46.7

CVSS 分數

參考連結(8)

• ADVISORYgithub.com/advisories/GHSA-vf7j-cmrj-pmmm
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-25723
• PATCHgithub.com/zenml-io/zenml
• PATCHpypi.org/project/zenml
• WEBgithub.com/zenml-io/zenml/compare/0.42.1...0.42.2