PT-2023-13714 · Vantage6 · Vantage6

Frankcorneliusmartin · Published 2023-02-28 · Updated 2023-03-09 · CVE-2022-39228

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions vantage6 versions prior to 3.8.0

Description vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. It does not inform the user of wrong username/password combination if the username actually exists, in an attempt to prevent bots from obtaining usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily.

Recommendations Update to version 3.8.0 or later to resolve the issue. As a temporary workaround, consider restricting the number of login attempts to minimize the risk of exploitation.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-204

CWE-203

Related Identifiers

CVE-2022-39228

GHSA-36GX-9Q6H-G429

PYSEC-2023-313

PYSEC-2023-52

Affected Products

Vantage6

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39228.json · Exploit
• https://github.com/vantage6/vantage6/commit/ab4381c35d24add06f75d5a8a284321f7a340bd2 · Patch
• https://github.com/vantage6/vantage6/pull/281 · Vendor Advisory
• https://github.com/vantage6/vantage6/issues/59 · Vendor Advisory
• https://github.com/vantage6/vantage6/security/advisories/GHSA-36gx-9q6h-g429 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39228 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-313 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-36gx-9q6h-g429 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-52 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39228 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2023-313.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2023-52.yaml · Note
• https://github.com/vantage6/vantage6 · Note
• https://t.me/cvenotify/45853 · Telegram Post
• https://t.me/cvenotify/45271 · Telegram Post