CVE-2024-2083: Directory Traversal in zenml-io/zenml
A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnerability by manipulating the 'logs' URI path in the request to fetch arbitrary file content, bypassing intended access restrictions. The vulnerability arises due to the lack of validation for directory traversal patterns, allowing attackers to access files outside of the restricted directory.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2083?
CVE-2024-2083 is classified as a high severity vulnerability due to its potential for unauthorized access to sensitive files.
How do I fix CVE-2024-2083?
To mitigate CVE-2024-2083, upgrade to zenml version 0.55.5 or later.
Which versions of zenml are affected by CVE-2024-2083?
CVE-2024-2083 affects all zenml versions prior to 0.55.5.
What type of vulnerability is CVE-2024-2083?
CVE-2024-2083 is a directory traversal vulnerability that allows attackers to access arbitrary file content.
Where can CVE-2024-2083 be exploited?
CVE-2024-2083 can be exploited through the /api/v1/steps endpoint of the zenml-io/zenml repository.