CVE-2024-2032

🗓️ 06 Jun 2024 18:49:18Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 77 Views🌐 WEB

Race condition vulnerability in zenml-io/zenml 0.55.3 allows creation of multiple users with same username when sent in parallel, fixed in 0.55.5

Reporter	Title	Published	Views	Family All 13
CNNVD	ZenML Security Vulnerability	6 Jun 202400:00	–	cnnvd
Cvelist	CVE-2024-2032 Race Condition Vulnerability in zenml-io/zenml	6 Jun 202418:49	–	cvelist
EUVD	EUVD-2024-0193	3 Oct 202520:07	–	euvd
Github Security Blog	Race condition in zenml	6 Jun 202421:30	–	github
NVD	CVE-2024-2032	6 Jun 202419:15	–	nvd
OSV	GHSA-C546-8JMQ-HPRJ Race condition in zenml	6 Jun 202421:30	–	osv
OSV	PYSEC-2024-105	6 Jun 202419:15	–	osv
Positive Technologies	PT-2024-18648 · Zenml Io · Zenml	6 Jun 202400:00	–	ptsecurity
PyPA	PYSEC-2024-105	6 Jun 202419:15	–	pypa
RedhatCVE	CVE-2024-2032	23 May 202507:22	–	redhatcve

NVD

Vulners

Vulnrichment

Node

zenml zenmlRange<0.55.5

[
  {
    "vendor": "zenml-io",
    "product": "zenml-io/zenml",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "0.55.5",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/zenml-io/zenml/commit/afcaf741ef9114c9b32f722f101b97de3d8d147b
huntr	www.huntr.com/bounties/6199cd5d-611f-4ea9-96c5-52a952ba5a56

Parameter	Position	Path	Description	CWE
username	path	api/v1/users/test_race	Race condition allowing creation of multiple users with the same username via concurrent requests to the user creation endpoint.	CWE-362, CWE-366

21 Nov 2024 09:08Current

3.7Low risk

Vulners AI Score3.7

CVSS 3.13.1

CVSS 33.1

EPSS0.00044

SSVC