CVE-2023-22738mediumCWE-281

CVE-2023-22738: fallo de gravedad media en vantage6

Improper Preservation of Permissions in vantage6

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear vantage6+ Monitorear vantage6

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.3epss 0.4%
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organizations is currently possible. It may lead to unintended access: if a user from organization A is accidentally assigned to organization B, they will retain their permissions and therefore might be able to access stuff they should not be allowed to access. This issue is patched in version 3.8.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Productos afectados
vantage6 · vantage6
CVEs relacionadas — vantage6

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-21649HIGHRemote code execution EPSS 1.3%CVE-2023-23930MEDIUMvantage6's Pickle serialization is insecureEPSS 1.1%CVE-2022-39228MEDIUMObservable Response Discrepancy in vantage6EPSS 0.6%CVE-2023-23929HIGHRefresh tokens do not expire in Vantage6EPSS 0.6%CVE-2023-28635MEDIUMDefining resource name as integer in vantage6 may give unintended accessEPSS 0.5%CVE-2023-41882MEDIUMvantage6 Improper Access Control vulnerabilityEPSS 0.5%