要点
- CVE-2024-32969 は vantage6 に影響する深刻度「低」 (CVSS 2.7) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.32%（全脆弱性の 24.9% より高い）。
- 対処：4.5.0rc3 以降に更新してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|
| vantage6 PyPI | < 4.5.0rc3
| 4.5.0rc3
|
概要
Impact
Collaboration administrators can add extra organizations to their collaboration. When doing that, they extend their influence: for instance, for organizations that they include, they can then create new users for which they know the passwords, and use that to read task results of other collaborations that that organization is involved in.
Only relatively trusted users - with access to manage a collaboration - are able to do this, which reduces the impact.
Patches
No
Workarounds
No
NVD の説明
vantage6 is an open-source infrastructure for privacy preserving analysis. Collaboration administrators can add extra organizations to their collaboration that can extend their influence. For example, organizations that they include can then create new users for which they know the passwords, and use that to read task results of other collaborations that that organization is involved in. This is only relatively trusted users - with access to manage a collaboration - are able to do this, which reduces the impact. This vulnerability was patched in version 4.5.0rc3.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン