CVE-2024-4311
CVSS 3.1 Score 6.1 of 10 (medium)
Details
Published Nov 14, 2024
Updated: Nov 15, 2024
CWE ID 79
Summary
CVE-2024-4311: ZenML's version 0.56.4 suffers from an account takeover vulnerability due to insufficient rate-limiting in the password change function. An attacker can attempt multiple password guesses without restriction on the '/api/v1/current-user' endpoint, potentially brute-forcing the current password and seizing control of the user's account. This issue can lead to unauthorized access, compromising the affected account's data and functionality.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Mozilla Firefox
Affected Vendors
- Mozilla