-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability exists in password update endpoints that lacked rate limiting. The patch adds RequestLimiter to both update_user and update_myself functions, which handle password changes. These functions verify the current password through UserAuthModel.verify_password without any attempt limiting in vulnerable versions. The CVE specifically mentions the /api/v1/current-user endpoint which maps to these functions. The commit diff shows rate limiting was added around the password verification logic in both functions, confirming they were the vulnerable points.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| zenml | pip | < 0.57.0rc2 | 0.57.0rc2 |