Lucene search

Veracode Vulnerability DatabaseVERACODE:47839

HistoryJul 01, 2024 - 10:13 a.m.

Cross Site Scripting(XSS)

2024-07-0110:13:10

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

zenml

cross-site scripting

xss

improper input neutralization

web page generation

survey redirect parameter

arbitrary javascript code

browser session

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

6 Medium

AI Score

Confidence

High

JSON

zenml is vulnerable to Cross-Site Scripting (XSS) . The vulnerability is due to improper input neutralization during web page generation within the survey redirect parameter, which allows an attacker to execute arbitrary JavaScript code in the context of the user’s browser session.

CPENameOperatorVersion
zenmlle0.57.1
zenmlle0.57.1

CPE	Name	Operator	Version
	zenml	le	0.57.1
	zenml	le	0.57.1

References

github.com/advisories/GHSA-3434-hc3m-8mmm

github.com/zenml-io/zenml/commit/21edd863c0ba53c1110b6f018a07c2d6853cf6d4

huntr.com/bounties/ceddd3c1-a9da-4d6c-85c4-41d4d1e1102f

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

6 Medium

AI Score

Confidence

High

JSON

Related for VERACODE:47839