ZenML < 0.57.0 Password Reset Brute Force (CVE-2024-4311)

The version of ZenML installed on the remote host is prior to 0.57.0. It is, therefore, affected by an account takeover exposure due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to...

CVE-2024-4311 Lack of login attempt rate-limiting in zenml-io/zenml

zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to take over the user's account. This vulnerability is due to the...