Reflected XSS through survey redirect parameter in zenml-io/zenml
Description
A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web page generation, specifically within the survey redirect parameter. This flaw allows an attacker to redirect users to a specified URL after completing a survey, without proper validation of the 'redirect' parameter. Consequently, an attacker can execute arbitrary JavaScript code in the context of the user's browser session. This vulnerability could be exploited to steal cookies, potentially leading to account takeover.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
zenmlPyPI | >= 0.57.1, < 0.58.0 | 0.58.0 |
Affected products
2- Range: unspecified
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-3434-hc3m-8mmmghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-5062ghsaADVISORY
- github.com/pypa/advisory-database/tree/main/vulns/zenml/PYSEC-2024-176.yamlghsaWEB
- github.com/zenml-io/zenml/commit/21edd863c0ba53c1110b6f018a07c2d6853cf6d4ghsaWEB
- huntr.com/bounties/ceddd3c1-a9da-4d6c-85c4-41d4d1e1102fghsaWEB
News mentions
0No linked articles in our index yet.