CVE-2024-2035: 
Python vulnerability analysis and mitigation

An improper authorization vulnerability (CVE-2024-2035) was discovered in the zenml-io/zenml repository, specifically affecting the API PUT /api/v1/users/id endpoint. The vulnerability was identified in version 0.55.3 and was subsequently fixed in version 0.56.2. This security flaw allows authenticated users to modify information of other users, including the ability to change the 'active' status of user accounts (NVD).

The vulnerability stems from insufficient authorization controls in the API endpoint that handles user information modifications. It has been assigned a CVSS v3.1 Base Score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H. The technical assessment indicates that while authentication is required, the vulnerability allows for privilege escalation through unauthorized modification of user account statuses (NVD).

The primary impact of this vulnerability is the potential for authenticated users to modify other users' information and deactivate user accounts, including administrator accounts. This could lead to significant disruption of application functionality and compromise of the security infrastructure by allowing unauthorized account modifications (NVD).

The vulnerability requires an authenticated user account to exploit, indicating a high prerequisite for exploitation. However, once authenticated, the exploitation process is straightforward, requiring only the ability to send modified requests to the affected API endpoint (NVD).

The vulnerability has been patched in zenml version 0.56.2. Users are advised to upgrade to this version or later to address the security issue. The fix was implemented through a commit that addresses the authorization vulnerability in the API endpoint (GitHub Patch).