CVE-2025-43863lowCWE-307

CVE-2025-43863: falha de baixa gravidade em vantage6

vantage6 lacks brute-force protection on change password functionality

Publicada em

Seguir esta CVE+ Monitorar vantage6+ Monitorar vantage6

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 1.7epss 0.5%
vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. If attacker gets access to an authenticated session, they can try to brute-force the user password by using the change password functionality: they can call that route infinitely which will return the message that password is wrong until it is correct. This vulnerability is fixed in 4.11.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U
Produtos afetados
vantage6 · vantage6
CVEs relacionadas — vantage6

No mesmo produto, das mais perigosas para as menos.

CVE-2024-21649HIGHRemote code execution EPSS 1.3%CVE-2023-23930MEDIUMvantage6's Pickle serialization is insecureEPSS 1.1%CVE-2022-39228MEDIUMObservable Response Discrepancy in vantage6EPSS 0.6%CVE-2023-23929HIGHRefresh tokens do not expire in Vantage6EPSS 0.6%CVE-2023-28635MEDIUMDefining resource name as integer in vantage6 may give unintended accessEPSS 0.5%CVE-2023-41882MEDIUMvantage6 Improper Access Control vulnerabilityEPSS 0.5%