CVE-2024-2383: Clickjacking Vulnerability in zenml-io/zenml
A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame-Options or Content-Security-Policy HTTP headers. This vulnerability allows an attacker to embed the application UI within an iframe on a malicious page, potentially leading to unauthorized actions by tricking users into interacting with the interface under the attacker's control. The issue was addressed in version 0.56.3.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2383?
CVE-2024-2383 is classified as a medium severity vulnerability due to its potential impact on application security.
How do I fix CVE-2024-2383?
To fix CVE-2024-2383, upgrade the zenml package to version 0.56.3 or later.
What versions of zenml are affected by CVE-2024-2383?
CVE-2024-2383 affects zenml versions up to and including 0.55.5.
What type of vulnerability is CVE-2024-2383?
CVE-2024-2383 is a clickjacking vulnerability related to improper HTTP header settings.
What can an attacker do with CVE-2024-2383?
An attacker can exploit CVE-2024-2383 by embedding the zenml application UI within an iframe to perform malicious actions.