{"data":{"id":"ad8cef21-1c6b-491e-9a49-ce6b664701cc","title":"CVE-2024-25723: ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because…","summary":"ZenML Server in the ZenML machine learning package for Python, before 0.46.7, allows remote privilege escalation. The /api/v1/users/{user_name_or_id}/activate REST API endpoint grants access given a valid username and a new password in the request body. Patched versions also include 0.44.4, 0.43.1, and 0.42.2.","solution":"Patched versions include 0.46.7 (versions before 0.46.7 are affected), along with 0.44.4, 0.43.1, and 0.42.2.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-25723","publishedAt":"2024-02-27T15:15:07.757Z","cveId":"CVE-2024-25723","cweIds":["CWE-284"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["zenml@< 0.42.2 (fixed: 0.42.2)","zenml@= 0.43.0 (fixed: 0.43.1)","zenml@>= 0.45.0, < 0.46.7 (fixed: 0.46.7)","zenml@>= 0.44.0, < 0.44.4 (fixed: 0.44.4)"],"affectedPackageNames":["zenml"],"affectedPackageRefs":["pypi:zenml"],"affectedVendors":[],"affectedVendorsRaw":["ZenML"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"ZenML Server privilege escalation through user activate REST API endpoint","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.70785,"epssCheckedAt":"2026-11-04T12:08:35.127Z","kevDateAdded":null,"advisoryAliases":["GHSA-vf7j-cmrj-pmmm"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:56:27.127Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2023-11-14T09:11:02.474Z","daysToFix":-105,"fixCheckedAt":"2026-10-29T21:46:21.299Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"zenml","fixedVersion":"0.43.1","matchedVersion":"0.43.1","fixReleasedAt":"2024-01-23T14:00:25.745Z","daysToFix":-35,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:46:21.078Z"},{"ecosystem":"pypi","name":"zenml","fixedVersion":"0.46.7","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":"tracked","status":"version_not_found","checkedAt":"2026-10-29T21:46:21.078Z"},{"ecosystem":"pypi","name":"zenml","fixedVersion":"0.44.4","matchedVersion":"0.44.4","fixReleasedAt":"2023-11-14T09:11:02.474Z","daysToFix":-105,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:46:21.078Z"},{"ecosystem":"pypi","name":"zenml","fixedVersion":"0.42.2","matchedVersion":"0.42.2","fixReleasedAt":"2024-01-23T13:58:02.378Z","daysToFix":-35,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:46:21.078Z"}]}}