CVE-2024-2260: Session Fixation Vulnerability in zenml-io/zenml
A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2260?
CVE-2024-2260 is classified as a high-severity vulnerability due to its potential to allow unauthorized access to user accounts.
How do I fix CVE-2024-2260?
To fix CVE-2024-2260, upgrade ZeusML to version 0.56.2 or later, where JWT token invalidation upon logout is properly implemented.
What is the impact of CVE-2024-2260?
The impact of CVE-2024-2260 allows an attacker to bypass authentication by reusing JWT tokens of logged-out users.
Which versions of ZenML are affected by CVE-2024-2260?
CVE-2024-2260 affects all versions of ZenML prior to 0.56.2.
Is user data at risk with CVE-2024-2260?
Yes, user data is at risk with CVE-2024-2260 since it can lead to unauthorized account access if not resolved.