CVE-2024-4311: Lack of login attempt rate-limiting in ZenML
ZenML's user authentication system lacked rate limiting on login and password reset attempts, enabling brute force attacks. The vulnerability was addressed by implementing rate limiting controls on failed request attempts.
What happened
The ZenML application lacked rate limiting on login attempts, allowing attackers to perform brute force attacks on user password reset operations.
Reported impact
The vulnerability enabled attackers to conduct brute force attacks against user credentials.
Governance controls
Rate limiting was added to user password reset operations in commit 87a6c2c, implementing a RequestLimiter context manager that tracks failed requests per IP address and resets the counter only upon successful requests.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.