CVE-2024-21671

Published: Jan 30, 2024

Modified: Oct 17, 2024

PUBLISHED

CVSS v3.1

3.7

LOW

Description

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks. Version 4.2.0 patches this vulnerability.

Vendor	Product	Versions
vantage6	vantage6	affected `< 4.2.0`

Weaknesses (CWE)

CWE-208

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

References

https://github.com/vantage6/vantage6/security/advisories/GHSA-45gq-q4xh-cp53

x_refsource_CONFIRM

https://github.com/vantage6/vantage6/commit/389f416c445da4f2438c72f34c3b1084485c4e30

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2024-21671

Description

Affected Products

Weaknesses (CWE)

CVSS v3.1 Details

References