PT-2023-18679 · Vantage6 · Vantage6

Frankcorneliusmartin · Publicado 2023-02-28 · Atualizado 2023-03-10 · CVE-2023-22738

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions vantage6 versions prior to 3.8.0

Description The issue concerns a privacy-preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organization is currently possible, which may lead to unintended access. If a user from one organization is accidentally assigned to another, they will retain their permissions and might be able to access data they should not be allowed to access.

Recommendations For versions prior to 3.8.0, update to version 3.8.0 to resolve the issue. As a temporary workaround, consider restricting user assignments to prevent accidental transfers between organizations until the update is applied.

Exploit

Correção

Improper Preservation of Permissions

Enumeração de Fraquezas

CWE-281

Identificadores relacionados

CVE-2023-22738

GHSA-VVJV-97J8-94XH

PYSEC-2023-53

Produtos afetados

Vantage6

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22738.json · Exploit
• https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2023-53.yaml · Nota
• https://github.com/vantage6/vantage6 · Nota
• https://github.com/vantage6/vantage6/security/advisories/GHSA-vvjv-97j8-94xh · Aviso do Fabricante
• https://github.com/vantage6/vantage6/commit/798aca1de142a4eca175ef51112e2235642f4f24 · Correção
• https://osv.dev/vulnerability/GHSA-vvjv-97j8-94xh · Aviso do Fabricante
• https://t.me/cibsecurity/59296 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-22738 · Nota de Segurança
• https://t.me/cvenotify/45315 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-22738 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2023-53 · Aviso do Fabricante