CVE-2023-41881lowCWE-200CWE-708

CVE-2023-41881: low-severity vulnerability in vantage6

Deleting a collaboration should also delete linked resources

Published · Updated

Follow this CVE+ Monitor vantage6+ Monitor vantage6

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.7epss 0.4%
In short

When a collaboration is deleted from vantage6, the linked resources like tasks aren't always removed. This could allow users in a new collaboration with the same ID to accidentally see data from the old deleted collaboration.

Technical detail

CWE-200/708: Improper resource deletion in vantage6 versions prior to 4.0.0 allows information disclosure when a collaboration is deleted but its associated resources remain; subsequent reuse of the same collaboration ID enables authenticated users to access orphaned data from the previous collaboration context.

Summary generated and translated by AI from the official description.
vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources (such as tasks from that collaboration) should be deleted. This is partly to manage data properly, but also to prevent a potential (but unlikely) side-effect that affects versions prior to 4.0.0, where if a collaboration with id=10 is deleted, and subsequently a new collaboration is created with id=10, the authenticated users in that collaboration could potentially see results of the deleted collaboration in some cases. Version 4.0.0 contains a patch for this issue. There are no known workarounds.
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected products
vantage6 · vantage6
Related CVEs — vantage6

In the same product, most dangerous first.

CVE-2024-21649HIGHRemote code execution EPSS 1.3%CVE-2023-23930MEDIUMvantage6's Pickle serialization is insecureEPSS 1.1%CVE-2022-39228MEDIUMObservable Response Discrepancy in vantage6EPSS 0.6%CVE-2023-23929HIGHRefresh tokens do not expire in Vantage6EPSS 0.6%CVE-2023-28635MEDIUMDefining resource name as integer in vantage6 may give unintended accessEPSS 0.5%CVE-2023-41882MEDIUMvantage6 Improper Access Control vulnerabilityEPSS 0.5%