Vantage6
CVE-2023-41881
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
1Blast Radius
ecosystem impact- 2 pypi packages depend on vantage6 (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.0.0.
DescriptionNVD
vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources (such as tasks from that collaboration) should be deleted. This is partly to manage data properly, but also to prevent a potential (but unlikely) side-effect that affects versions prior to 4.0.0, where if a collaboration with id=10 is deleted, and subsequently a new collaboration is created with id=10, the authenticated users in that collaboration could potentially see results of the deleted collaboration in some cases. Version 4.0.0 contains a patch for this issue. There are no known workarounds.
AnalysisAI
vantage6 is privacy preserving federated learning infrastructure. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Technical ContextAI
This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources (such as tasks from that collaboration) should be deleted. This is partly to manage data properly, but also to prevent a potential (but unlikely) side-effect that affects versions prior to 4.0.0, where if a collaboration with id=10 is deleted, and subsequently a new collaboration is created with id=10, the authenticated users in that collaboration could potentially see results of the deleted collaboration in some cases. Version 4.0.0 contains a patch for this issue. There are no known workarounds. Affected products include: Vantage6. Version information: prior to 4.0.0.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.
vantage6 is privacy preserving federated learning infrastructure. Rated high severity (CVSS 7.2), this vulnerability is
Critical authentication bypass vulnerability in vantage6 (an open-source federated learning and privacy-enhancing techno
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Mul
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Mul
vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Rated high severity (CVS
vantage6 servers auto-generate JWT secret keys using UUID1, a predictable algorithm that lacks cryptographic strength, a
Default hardcoded admin credentials in vantage6 expose servers running versions prior to 5.0.0 to unauthorized administr
Improper access control in vantage6 nodes prior to version 5.0.0 allows malicious algorithm containers to read input and
vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Le
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Rated medium severity (C
vantage6 is privacy preserving federated learning infrastructure. Rated medium severity (CVSS 5.4), this vulnerability i
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today