Vantage6
CVE-2024-22193
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
1Blast Radius
ecosystem impact- 2 pypi packages depend on vantage6 (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.2.0.
DescriptionNVD
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. Therefore, a user may accidentally create a task with sensitive input data that will then be stored unencrypted in a database. Users should ensure they set the encryption setting correctly. This vulnerability is patched in 4.2.0.
AnalysisAI
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Technical ContextAI
This vulnerability is classified under CWE-922. The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. Therefore, a user may accidentally create a task with sensitive input data that will then be stored unencrypted in a database. Users should ensure they set the encryption setting correctly. This vulnerability is patched in 4.2.0. Affected products include: Vantage6.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
vantage6 is privacy preserving federated learning infrastructure. Rated high severity (CVSS 7.2), this vulnerability is
Critical authentication bypass vulnerability in vantage6 (an open-source federated learning and privacy-enhancing techno
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Mul
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Mul
vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Rated high severity (CVS
vantage6 servers auto-generate JWT secret keys using UUID1, a predictable algorithm that lacks cryptographic strength, a
Default hardcoded admin credentials in vantage6 expose servers running versions prior to 5.0.0 to unauthorized administr
Improper access control in vantage6 nodes prior to version 5.0.0 allows malicious algorithm containers to read input and
vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Le
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Rated medium severity (C
vantage6 is privacy preserving federated learning infrastructure. Rated medium severity (CVSS 5.4), this vulnerability i
Same weakness CWE-922 – Insecure Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today