CVE-2024-2171
Stored XSS in zenml-io/zenml
- State
- Published
- Severity
- 3.4 Low
- Published
- Jun 6, 2024
- Updated
- Aug 9, 2024
- Reserved
- Mar 4, 2024
Description
A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logo_url' field. By injecting malicious payloads into this field, an attacker could send harmful messages to other users, potentially compromising their accounts. The vulnerability affects version 0.55.3 and was fixed in version 0.56.2. The impact of exploiting this vulnerability could lead to user account compromise.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 3.4 Low | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N | @huntr_ai |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
zenml-io/zenmlzenml-io |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.