CVE-2024-2171: Stored XSS in zenml-io/zenml
A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logourl' field. By injecting malicious payloads into this field, an attacker could send harmful messages to other users, potentially compromising their accounts. The vulnerability affects version 0.55.3 and was fixed in version 0.56.2. The impact of exploiting this vulnerability could lead to user account compromise.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2171?
CVE-2024-2171 has been classified as a medium severity vulnerability due to its potential to compromise user accounts.
How do I fix CVE-2024-2171?
To fix CVE-2024-2171, upgrade zenml to version 0.56.2 or later to eliminate the stored XSS vulnerability.
What type of vulnerability is CVE-2024-2171?
CVE-2024-2171 is a stored Cross-Site Scripting (XSS) vulnerability affecting the logo_url field in zenml.
What impact does CVE-2024-2171 have on user accounts?
CVE-2024-2171 could allow attackers to inject malicious scripts, potentially sending harmful messages to other users and compromising their accounts.
Which versions of zenml are affected by CVE-2024-2171?
Versions of zenml up to and including 0.56.2 are affected by CVE-2024-2171.