CVE-2023-23930mediumCWE-502

CVE-2023-23930: falha de média gravidade em vantage6

vantage6's Pickle serialization is insecure

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar vantage6+ Monitorar vantage6

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.5epss 1.1%
vantage6 is privacy preserving federated learning infrastructure. Versions prior to 4.0.0 use pickle, which has known security issue, as a default serialization module but that has known security issues. All users of vantage6 that post tasks with the default serialization are affected. Version 4.0.0 contains a patch. Users may specify JSON serialization as a workaround.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Produtos afetados
vantage6 · vantage6
CVEs relacionadas — vantage6

No mesmo produto, das mais perigosas para as menos.

CVE-2024-21649HIGHRemote code execution EPSS 1.3%CVE-2022-39228MEDIUMObservable Response Discrepancy in vantage6EPSS 0.6%CVE-2023-23929HIGHRefresh tokens do not expire in Vantage6EPSS 0.6%CVE-2023-28635MEDIUMDefining resource name as integer in vantage6 may give unintended accessEPSS 0.5%CVE-2023-41882MEDIUMvantage6 Improper Access Control vulnerabilityEPSS 0.5%CVE-2025-43863LOWvantage6 lacks brute-force protection on change password functionalityEPSS 0.5%