CVE-2024-5062

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-5062
A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web page generation, specifically within the survey redirect parameter. This flaw allows an attacker to redirect users to a specified URL after completing a survey, without proper validation of the 'redirect' parameter. Consequently, an attacker can execute arbitrary JavaScript code in the context of the user's browser session. This vulnerability could be exploited to steal cookies, potentially leading to account takeover.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/zenml-io/zenml/commit/21edd863c0ba53c1110b6f018a07c2d6853cf6d4 Patch
https://huntr.com/bounties/ceddd3c1-a9da-4d6c-85c4-41d4d1e1102f Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:zenml:zenml:*:*:*:*:*:*:*:*
History

20 Aug 2024, 14:14

Type Values Removed Values Added
First Time Zenml zenml
Zenml
References () https://github.com/zenml-io/zenml/commit/21edd863c0ba53c1110b6f018a07c2d6853cf6d4 - () https://github.com/zenml-io/zenml/commit/21edd863c0ba53c1110b6f018a07c2d6853cf6d4 - Patch
References () https://huntr.com/bounties/ceddd3c1-a9da-4d6c-85c4-41d4d1e1102f - () https://huntr.com/bounties/ceddd3c1-a9da-4d6c-85c4-41d4d1e1102f - Exploit
CVSS v2 : unknown
v3 : 5.3 		v2 : unknown
v3 : 6.1
CPE cpe:2.3:a:zenml:zenml:*:*:*:*:*:*:*:*

01 Jul 2024, 12:37

Type Values Removed Values Added
Summary
  • (es) Se identificó una vulnerabilidad de Cross-Site Scripting (XSS) Reflejado en zenml-io/zenml versión 0.57.1. La vulnerabilidad existe debido a una neutralización inadecuada de la entrada durante la generación de la página web, específicamente dentro del parámetro de redireccionamiento de la encuesta. Esta falla permite a un atacante redirigir a los usuarios a una URL específica después de completar una encuesta, sin una validación adecuada del parámetro "redirect". En consecuencia, un atacante puede ejecutar código JavaScript arbitrario en el contexto de la sesión del navegador del usuario. Esta vulnerabilidad podría aprovecharse para robar cookies, lo que podría llevar a la apropiación de cuentas.

30 Jun 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-30 16:15

Updated : 2024-08-20 14:14

NVD link : CVE-2024-5062

Mitre link : CVE-2024-5062

CVE.ORG link : CVE-2024-5062

JSON object : View

Products Affected

zenml

  • zenml
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')