Vantage6
CVE-2023-47631
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). In affected versions a node does not check if an image is allowed to run if a parent_id is set. A malicious party that breaches the server may modify it to set a fake parent_id and send a task of a non-whitelisted algorithm. The node will then execute it because the parent_id that is set prevents checks from being run. This impacts all servers that are breached by an expert user. This vulnerability has been patched in version 4.1.2. All users are advised to upgrade. There are no known workarounds for this vulnerability.
AnalysisAI
vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Technical ContextAI
This vulnerability is classified under CWE-345. vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). In affected versions a node does not check if an image is allowed to run if a parent_id is set. A malicious party that breaches the server may modify it to set a fake parent_id and send a task of a non-whitelisted algorithm. The node will then execute it because the parent_id that is set prevents checks from being run. This impacts all servers that are breached by an expert user. This vulnerability has been patched in version 4.1.2. All users are advised to upgrade. There are no known workarounds for this vulnerability. Affected products include: Vantage6. Version information: version 4.1.2..
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
vantage6 is privacy preserving federated learning infrastructure. Rated high severity (CVSS 7.2), this vulnerability is
Critical authentication bypass vulnerability in vantage6 (an open-source federated learning and privacy-enhancing techno
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Mul
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Mul
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Rated high severity (CVS
vantage6 servers auto-generate JWT secret keys using UUID1, a predictable algorithm that lacks cryptographic strength, a
Default hardcoded admin credentials in vantage6 expose servers running versions prior to 5.0.0 to unauthorized administr
Improper access control in vantage6 nodes prior to version 5.0.0 allows malicious algorithm containers to read input and
vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Le
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Rated medium severity (C
vantage6 is privacy preserving federated learning infrastructure. Rated medium severity (CVSS 5.4), this vulnerability i
vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Le
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today