PT-2023-18679 · Vantage6 · Vantage6

Frankcorneliusmartin · Published 2023-02-28 · Updated 2023-03-10 · CVE-2023-22738

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions vantage6 versions prior to 3.8.0

Description The issue concerns a privacy-preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organization is currently possible, which may lead to unintended access. If a user from one organization is accidentally assigned to another, they will retain their permissions and might be able to access data they should not be allowed to access.

Recommendations For versions prior to 3.8.0, update to version 3.8.0 to resolve the issue. As a temporary workaround, consider restricting user assignments to prevent accidental transfers between organizations until the update is applied.

Exploit

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2023-22738

GHSA-VVJV-97J8-94XH

PYSEC-2023-53

Affected Products

Vantage6

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22738.json · Exploit
• https://github.com/vantage6/vantage6/security/advisories/GHSA-vvjv-97j8-94xh · Vendor Advisory
• https://github.com/vantage6/vantage6/commit/798aca1de142a4eca175ef51112e2235642f4f24 · Patch
• https://osv.dev/vulnerability/GHSA-vvjv-97j8-94xh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22738 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22738 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-53 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2023-53.yaml · Note
• https://github.com/vantage6/vantage6 · Note
• https://t.me/cibsecurity/59296 · Telegram Post
• https://t.me/cvenotify/45315 · Telegram Post