CVE-2024-32969

vantage6 is an open-source infrastructure for privacy preserving analysis. Collaboration administrators can add extra organizations to their collaboration that can extend their influence. For example, organizations that they include can then create new users for which they know the passwords, and use that to read task results of other collaborations that that organization is involved in. This is only relatively trusted users - with access to manage a collaboration - are able to do this, which reduces the impact. This vulnerability was patched in version 4.5.0rc3.

CVSS v3 2.7 LOW

2.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/vantage6/vantage6/commit/27f4ee3fade5f4cbcf3e60899c9a2a91145e0b56
https://github.com/vantage6/vantage6/security/advisories/GHSA-99r4-cjp4-3hmx

Configurations

No configuration.

History

No history.

Information

Published : 2024-05-23 09:15

Updated : 2024-05-24 01:15

NVD link : CVE-2024-32969

Mitre link : CVE-2024-32969

CVE.ORG link : CVE-2024-32969

JSON object : View

Products Affected

No product.

CWE

CWE-284

Improper Access Control

{"id": "CVE-2024-32969", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.2}]}, "published": "2024-05-23T09:15:09.350", "references": [{"url": "https://github.com/vantage6/vantage6/commit/27f4ee3fade5f4cbcf3e60899c9a2a91145e0b56", "source": "security-advisories@github.com"}, {"url": "https://github.com/vantage6/vantage6/security/advisories/GHSA-99r4-cjp4-3hmx", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "vantage6 is an open-source infrastructure for privacy preserving analysis. Collaboration administrators can add extra organizations to their collaboration that can extend their influence. For example, organizations that they include can then create new users for which they know the passwords, and use that to read task results of other collaborations that that organization is involved in. This is only relatively trusted users - with access to manage a collaboration - are able to do this, which reduces the impact. This vulnerability was patched in version 4.5.0rc3.\n"}, {"lang": "es", "value": "vantage6 es una infraestructura de c\u00f3digo abierto para an\u00e1lisis de preservaci\u00f3n de la privacidad. Los administradores de colaboraci\u00f3n pueden agregar organizaciones adicionales a su colaboraci\u00f3n que puedan ampliar su influencia. Por ejemplo, las organizaciones que incluyen pueden crear nuevos usuarios cuyas contrase\u00f1as conocen y usarlas para leer los resultados de tareas de otras colaboraciones en las que participa esa organizaci\u00f3n. Estos son solo usuarios relativamente confiables, con acceso para administrar una colaboraci\u00f3n. son capaces de hacer esto, lo que reduce el impacto. Esta vulnerabilidad fue parcheada en la versi\u00f3n 4.5.0rc3."}], "lastModified": "2024-05-24T01:15:30.977", "sourceIdentifier": "security-advisories@github.com"}