CVE-2023-41882

vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, prior to version 4.0.0, it is only checked if the user has permission to view the collaboration. Version 4.0.0 contains a patch. There are no known workarounds.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400	Release Notes
https://github.com/vantage6/vantage6/pull/711	Patch
https://github.com/vantage6/vantage6/security/advisories/GHSA-gc57-xhh5-m94r	Third Party Advisory
https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400	Release Notes
https://github.com/vantage6/vantage6/pull/711	Patch
https://github.com/vantage6/vantage6/security/advisories/GHSA-gc57-xhh5-m94r	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:vantage6:vantage6:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:21

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-11 20:15

Updated : 2024-11-21 08:21

NVD link : CVE-2023-41882

Mitre link : CVE-2023-41882

CVE.ORG link : CVE-2023-41882

JSON object : View

Products Affected

vantage6

vantage6

CWE

CWE-284

Improper Access Control

CWE-863

Incorrect Authorization

{"id": "CVE-2023-41882", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2023-10-11T20:15:10.700", "references": [{"url": "https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vantage6/vantage6/pull/711", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vantage6/vantage6/security/advisories/GHSA-gc57-xhh5-m94r", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/vantage6/vantage6/pull/711", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/vantage6/vantage6/security/advisories/GHSA-gc57-xhh5-m94r", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, prior to version 4.0.0, it is only checked if the user has permission to view the collaboration. Version 4.0.0 contains a patch. There are no known workarounds."}, {"lang": "es", "value": "vantage6 es una infraestructura de aprendizaje federada que preserva la privacidad. El endpoint /api/collaboration/{id}/task se utiliza para recopilar todas las tareas de una determinada colaboraci\u00f3n. Para realizar dichas tareas, un usuario debe tener permiso para ver la colaboraci\u00f3n y las tareas que contiene. Sin embargo, antes de la versi\u00f3n 4.0.0, solo se verifica si el usuario tiene permiso para ver la colaboraci\u00f3n. La versi\u00f3n 4.0.0 contiene un parche. No se conocen workarounds."}], "lastModified": "2024-11-21T08:21:50.793", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vantage6:vantage6:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21C07998-FF3A-4F49-B6B7-97E89CB0A6B4", "versionEndExcluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}