CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCVE-2024-22193
Medium (4.3) in vantage6 vantage6. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in vantage6 4.2.0.
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. Therefore, a user may accidentally create a task with sensitive input data that will then be stored unencrypted in a database. Users should ensure they set the encryption setting correctly. This vulnerability is patched in 4.2.0.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
- CWE
- CWE-922
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vantage6:vantage6
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rjmv-52mp-gjrr | PyPI | vantage6 | <4.2.0 | 4.2.0 |
| PYSEC-2024-32 | PyPI | vantage6 | <4.2.0 | 4.2.0 |
References
- https://github.com/vantage6/vantage6/commit/6383283733b81abfcacfec7538dc4dc882e98074
- https://github.com/vantage6/vantage6/security/advisories/GHSA-rjmv-52mp-gjrr
- https://github.com/vantage6/vantage6/commit/6383283733b81abfcacfec7538dc4dc882e98074
- https://github.com/vantage6/vantage6/security/advisories/GHSA-rjmv-52mp-gjrr