← Volver a CVEs

CVE-2023-22738

MEDIUM

6.3

Descripcion

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organizations is currently possible. It may lead to unintended access: if a user from organization A is accidentally assigned to organization B, they will retain their permissions and therefore might be able to access stuff they should not be allowed to access. This issue is patched in version 3.8.0.

Detalles CVE

Puntuacion CVSS v3.16.3

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioREQUIRED

Publicado3/1/2023

Ultima modificacion11/21/2024

Fuentenvd

Avistamientos honeypot0

Productos afectados

vantage6:vantage6

Debilidades (CWE)

CWE-281CWE-281

Referencias

https://github.com/vantage6/vantage6/commit/798aca1de142a4eca175ef51112e2235642f4f24(security-advisories@github.com)

https://github.com/vantage6/vantage6/security/advisories/GHSA-vvjv-97j8-94xh(security-advisories@github.com)

https://github.com/vantage6/vantage6/commit/798aca1de142a4eca175ef51112e2235642f4f24(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/vantage6/vantage6/security/advisories/GHSA-vvjv-97j8-94xh(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.