Vantage6
CVE-2023-23929
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1Blast Radius
ecosystem impact- 2 pypi packages depend on vantage6 (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 3.8.0.
DescriptionNVD
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.
AnalysisAI
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Technical ContextAI
This vulnerability is classified under CWE-613. vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0. Affected products include: Vantage6. Version information: version 3.8.0..
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
vantage6 is privacy preserving federated learning infrastructure. Rated high severity (CVSS 7.2), this vulnerability is
Critical authentication bypass vulnerability in vantage6 (an open-source federated learning and privacy-enhancing techno
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Mul
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Mul
vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party
vantage6 servers auto-generate JWT secret keys using UUID1, a predictable algorithm that lacks cryptographic strength, a
Default hardcoded admin credentials in vantage6 expose servers running versions prior to 5.0.0 to unauthorized administr
Improper access control in vantage6 nodes prior to version 5.0.0 allows malicious algorithm containers to read input and
vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Le
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Rated medium severity (C
vantage6 is privacy preserving federated learning infrastructure. Rated medium severity (CVSS 5.4), this vulnerability i
vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Le
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today