CVE-2024-2383

MEDIUM EPSS 27.3%
Published Jun 6, 20242y ago · Modified Jun 17, 20261w ago
6.1 CVSS 3.1
Medium
Find Similar
Published Jun 6, 2024 2y ago
Last Modified Jun 17, 2026 1w ago

Description

A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame-Options or Content-Security-Policy HTTP headers. This vulnerability allows an attacker to embed the application UI within an iframe on a malicious page, potentially leading to unauthorized actions by tricking users into interacting with the interface under the attacker's control. The issue was addressed in version 0.56.3.

CVSS Details

Base Score
6.1
Exploitability
2.8
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
27.3% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-1021

Affected Products 1

VendorProductVersionRange
zenmlzenml* <0.56.3

References 2

  • github.com https://github.com/zenml-io/zenml/commit/f863fde1269bc355951f8cfc826c0244d88ad5e9
    Patch
  • huntr.com https://huntr.com/bounties/22d26f5a-c0ae-4344-aa7d-08ff5ada3963
    ExploitIssue TrackingPatchThird Party Advisory

Remediation

  • github.com https://github.com/zenml-io/zenml/commit/f863fde1269bc355951f8cfc826c0244d88ad5e9
    Patch
  • huntr.com https://huntr.com/bounties/22d26f5a-c0ae-4344-aa7d-08ff5ada3963
    ExploitIssue TrackingPatchThird Party Advisory