Back

CVE-2024-5062

June 30, 2024, 4:15 p.m.

Received
CVE has been recently published to the CVE List and has been received by the NVD.

Products

zenml-io/zenml

  • 0.57.1

Source

security@huntr.dev

Tags

CWE-79
security@huntr.dev
2024-06-30
CVE-2024-5062

CVE-2024-5062 details

Published : June 30, 2024, 4:15 p.m.
Last Modified : June 30, 2024, 4:15 p.m.

Description

A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web page generation, specifically within the survey redirect parameter. This flaw allows an attacker to redirect users to a specified URL after completing a survey, without proper validation of the 'redirect' parameter. Consequently, an attacker can execute arbitrary JavaScript code in the context of the user's browser session. This vulnerability could be exploited to steal cookies, potentially leading to account takeover.

CVSS Score

1 2 3 4 5.3 6 7 8 9 10

Weakness

Weakness Name Description
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVSS Data

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

Base Score

5.3

Exploitability Score

1.6

Impact Score

3.6

Base Severity

MEDIUM

Vector String : CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

References

URL Source
https://github.com/zenml-io/zenml/commit/21edd863c0ba53c1110b6f018a07c2d6853cf6d4 security@huntr.dev
https://huntr.com/bounties/ceddd3c1-a9da-4d6c-85c4-41d4d1e1102f security@huntr.dev
This website uses the NVD API, but is not approved or certified by it.