CVE-2024-4311Medium· 5.4▾ SunlitMissing ratelimit on passwrod resets in zenml
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.5%
0.5% → 0.5%
zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to take over the user's account. This vulnerability is due to the absence of rate-limiting on the '/api/v1/current-user' endpoint, which does not restrict the number of attempts an attacker can make to guess the current password. Successful exploitation results in the attacker being able to change the password and take control of the account.
zenml < 0.57.0rc2Upgrade to a patched release:
zenml 0.57.0rc2Connected by shared product, vendor, weakness, or advisory.
CVE-2024-25723Medium· 6.5ZenML Server Remote Privilege Escalation Vulnerability
CVE-2025-8406Medium· 6.3ZenML is vulnerable to Path Traversal through its `PathMaterializer` class
CVE-2024-4680Low· 3.9zenml-io/zenml does not expire the session after password reset
CVE-2024-4460Medium· 4.3Improper line feed handling in zenml