💣Exploit CVE-2024-4680 - A vulnerability in zenml-io/zenml version 0.56.3 a

[Maksim]

CVE ID : CVE-2024-4680
Published : June 8, 2024, 8:15 p.m. | 20 minutes ago
Description : A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access to a compromised account without the victim's ability to revoke this access. This issue was observed in a self-hosted ZenML deployment via Docker, where after changing the password from one browser, the session remained active and usable in another browser without requiring re-authentication.
Severity: 3.9 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
Full story here:

To view the content, you need to Sign In or Register.