CVE-2024-4311: 
Python vulnerability analysis and mitigation

A vulnerability was discovered in zenml-io/zenml version 0.56.4 that allows for account takeover due to insufficient rate-limiting in the password change functionality. The vulnerability was assigned CVE-2024-4311 and was disclosed on November 14, 2024 (NVD).

The vulnerability stems from the absence of rate-limiting on the '/api/v1/current-user' endpoint, which handles password changes. This implementation flaw allows attackers to perform unlimited password guessing attempts through the 'Update Password' function. The vulnerability has been assigned a CVSS v3.0 base score of 5.4 (Medium) with the vector string CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H (NVD).

If successfully exploited, this vulnerability enables attackers to take control of user accounts by brute-forcing the current password through the password change function. Once the correct password is guessed, the attacker can change it and gain full access to the compromised account (NVD).

The vulnerability has been patched by implementing rate limiting for user password reset operations. The fix was committed to the repository with commit ID 87a6c2c8f45b49ea83fbb5fe8fff7ab5365a60c9 (GitHub Commit).