PT-2023-13714 · Vantage6 · Vantage6

Frankcorneliusmartin · Publicado 2023-02-28 · Atualizado 2023-03-09 · CVE-2022-39228

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions vantage6 versions prior to 3.8.0

Description vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. It does not inform the user of wrong username/password combination if the username actually exists, in an attempt to prevent bots from obtaining usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily.

Recommendations Update to version 3.8.0 or later to resolve the issue. As a temporary workaround, consider restricting the number of login attempts to minimize the risk of exploitation.

Exploit

Correção

Side Channel Attack

Enumeração de Fraquezas

CWE-204

CWE-203

Identificadores relacionados

CVE-2022-39228

GHSA-36GX-9Q6H-G429

PYSEC-2023-313

PYSEC-2023-52

Produtos afetados

Vantage6

Referências · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39228.json · Exploit
• https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2023-313.yaml · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2023-52.yaml · Nota
• https://github.com/vantage6/vantage6 · Nota
• https://github.com/vantage6/vantage6/commit/ab4381c35d24add06f75d5a8a284321f7a340bd2 · Correção
• https://github.com/vantage6/vantage6/pull/281 · Aviso do Fabricante
• https://github.com/vantage6/vantage6/issues/59 · Aviso do Fabricante
• https://github.com/vantage6/vantage6/security/advisories/GHSA-36gx-9q6h-g429 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-39228 · Nota de Segurança
• https://t.me/cvenotify/45853 · Publicação no Telegram
• https://osv.dev/vulnerability/PYSEC-2023-313 · Aviso do Fabricante
• https://t.me/cvenotify/45271 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-36gx-9q6h-g429 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2023-52 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-39228 · Aviso do Fabricante