CVE Feed

    Dashboard / CVE / CVE-2024-5062

    CVE-2024-5062

    A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web page generation, specifically within the survey redirect parameter. This flaw allows an attacker to redirect users to a specified URL after completing a survey, without proper validation of the 'redirect' parameter. Consequently, an attacker can execute arbitrary JavaScript code in the context of the user's browser session. This vulnerability could be exploited to steal cookies, potentially leading to account takeover.

    Published:Jun 30, 2024
    Last Modified:Nov 21, 2024
    EPS:Jun 30, 2024
    EPSS Score:0.00162
    CVSS Score:6.1

    Affected Products

    Vendor
    Zenml
    Product
    Zenml

    Exploits

    https://huntr.com/bounties/ceddd3c1-a9da-4d6c-85c4-41d4d1e1102fhttps://huntr.com/bounties/ceddd3c1-a9da-4d6c-85c4-41d4d1e1102f

    Related CVEs

    CVE-2026-68772 (CVSS 8.5) — ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allo…
    CVE-2025-8406 (CVSS 7.8) — ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load`…
    CVE-2024-9340 (CVSS 7.5) — A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to c…
    CVE-2024-4311 (CVSS 5.4) — zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the pas…
    CVE-2024-4680 (CVSS 8.8) — A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session …
    CVE-2024-2032 (CVSS 3.1) — A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for …
    CVE-2024-2035 (CVSS 6.5) — An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API P…
    CVE-2024-2171 (CVSS 4.8) — A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specificall…
    CVE-2024-2213 (CVSS 3.3) — An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication …
    CVE-2024-2383 (CVSS 6.1) — A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the applicati…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High