From 1bd2160803ec9ba5e0d5c8832a6f4c961f8d11d4 Mon Sep 17 00:00:00 2001 From: Prince Chaddha Date: Mon, 8 Apr 2024 13:08:38 +0530 Subject: [PATCH] Update CVE-2024-25723.yaml --- passive/cves/2024/CVE-2024-25723.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/passive/cves/2024/CVE-2024-25723.yaml b/passive/cves/2024/CVE-2024-25723.yaml index 16b1b7edf6..611ffe34ae 100644 --- a/passive/cves/2024/CVE-2024-25723.yaml +++ b/passive/cves/2024/CVE-2024-25723.yaml @@ -4,7 +4,7 @@ info: name: ZenML ZenML Server - Improper Authentication author: David Botelho Mariano severity: critical - description: + description: | ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. impact: | Successful exploitation could lead to unauthorized access to sensitive data.