THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-2383

Clickjacking Vulnerability in zenml-io/zenml

Reserved:2024-03-11
Published:2024-06-06
Updated:2024-06-07

Description

A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame-Options or Content-Security-Policy HTTP headers. This vulnerability allows an attacker to embed the application UI within an iframe on a malicious page, potentially leading to unauthorized actions by tricking users into interacting with the interface under the attacker's control. The issue was addressed in version 0.56.3.



MEDIUM: 4.3CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Problem types

CWE-1021 Improper Restriction of Rendered UI Layers or Frames

Product status

Any version before 0.56.3
affected

References

https://huntr.com/bounties/22d26f5a-c0ae-4344-aa7d-08ff5ada3963

https://github.com/zenml-io/zenml/commit/f863fde1269bc355951f8cfc826c0244d88ad5e9

cve.org CVE-2024-2383

nvd.nist.gov CVE-2024-2383

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-2383