How severe is CVE-2024-2083?

CVE-2024-2083 has a CVSS 3.x base score of 9.9, rated critical severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2024-2083 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 39% (98th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-2083?

CVE-2024-2083 affects Zenml. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-2083?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2024-2083 have an EU (EUVD) identifier?

Yes. CVE-2024-2083 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-1126.

When was CVE-2024-2083 published?

CVE-2024-2083 was published on 2024-04-16 and last updated on 2026-06-17.

CVE-2024-2083

CVE-2024-2083 is a critical-severity vulnerability in Zenml with a CVSS 3.x base score of 9.9. Its EPSS exploit-prediction score of 39% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-29.

Key facts

Severity: Critical (CVSS 3.x base score 9.9)
EPSS exploit prediction: 39% (98th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-1126
Weakness: CWE-29
Affected product: Zenml
Published: 2024-04-16
Last modified: 2026-06-17

Description

A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnerability by manipulating the 'logs' URI path in the request to fetch arbitrary file content, bypassing intended access restrictions. The vulnerability arises due to the lack of validation for directory traversal patterns, allowing attackers to access files outside of the restricted directory.

Frequently asked questions

What is CVE-2024-2083?: A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnerability by manipulating the 'logs' URI path in the request to fetch arbitrary file content, bypassing intended access restrictions. The vulnerability arises due to the lack of validation for directory traversal patterns, allowing attackers to access files outside of the restricted directory.
How severe is CVE-2024-2083?: CVE-2024-2083 has a CVSS 3.x base score of 9.9, rated critical severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2024-2083 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 39% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-2083?: CVE-2024-2083 affects Zenml. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-2083?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2024-2083 have an EU (EUVD) identifier?: Yes. CVE-2024-2083 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-1126.
When was CVE-2024-2083 published?: CVE-2024-2083 was published on 2024-04-16 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:zenml:zenml:*:*:*:*:*:*:*:*

More vulnerabilities in Zenml

CVE-2024-4680 — High (CVSS 8.8): A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due…
CVE-2024-28424 — High (CVSS 8.8): zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at…
CVE-2024-25723 — High (CVSS 8.8): ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because…
CVE-2025-8406 — High (CVSS 7.8): ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load` function…
CVE-2024-9340 — High (CVSS 7.5): A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause…
CVE-2024-2035 — Medium (CVSS 6.5): An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT…

All CVEs affecting Zenml →

Other CWE-29 vulnerabilities

CVE-2025-15036 — Critical (CVSS 10.0): A path traversal vulnerability exists in the `extract_archive_to_dir` function within the…
CVE-2024-6396 — Critical (CVSS 9.8): A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any…
CVE-2024-5443 — Critical (CVSS 9.8): CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the…
CVE-2024-2358 — Critical (CVSS 9.8): A path traversal vulnerability in the '/apply_settings' endpoint of parisneo/lollms-webui allows attackers to execute…
CVE-2023-6975 — Critical (CVSS 9.8): A malicious user could use this issue to get command execution on the vulnerable machine and get access to data &…
CVE-2023-2780 — Critical (CVSS 9.8): Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1.

Browse all CWE-29 vulnerabilities →