PT-2023-21864 · Vantage6 · Vantage6
Frankcorneliusmartin
·
Published
2023-10-11
·
Updated
2023-10-17
·
CVE-2023-28635
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
vantage6 versions prior to 4.0.0
Description
The issue affects vantage6, a privacy-preserving federated learning infrastructure. Malicious users may attempt to access resources they are not allowed to see by creating resources with integers as names. This can lead to issues, for example, when defining which users are allowed to run algorithms on their node, where the definition may be based on
username or user id. If a user with user id 13 is allowed to run tasks and an attacker creates a username '13', the attacker would be wrongly allowed to run an algorithm. There may be other places in the code where such a mixup of resource ID or name leads to issues.Recommendations
To resolve the issue, update to version 4.0.0 or later, as it contains a patch for this issue. As a temporary workaround, consider checking when resources are created or modified to ensure the resource name always starts with a character.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Vantage6