CVE-2023-23929highCWE-613

CVE-2023-23929: falha de alta gravidade em vantage6

Refresh tokens do not expire in Vantage6

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar vantage6+ Monitorar vantage6

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.6%
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
vantage6 · vantage6
CVEs relacionadas — vantage6

No mesmo produto, das mais perigosas para as menos.

CVE-2024-21649HIGHRemote code execution EPSS 1.3%CVE-2023-23930MEDIUMvantage6's Pickle serialization is insecureEPSS 1.1%CVE-2022-39228MEDIUMObservable Response Discrepancy in vantage6EPSS 0.6%CVE-2023-28635MEDIUMDefining resource name as integer in vantage6 may give unintended accessEPSS 0.5%CVE-2023-41882MEDIUMvantage6 Improper Access Control vulnerabilityEPSS 0.5%CVE-2025-43863LOWvantage6 lacks brute-force protection on change password functionalityEPSS 0.5%