Tóm tắt nhanh
- CVE-2023-41881 là lỗ hổng mức TRUNG BÌNH (CVSS 4.3) ảnh hưởng vantage6, vantage6 (vantage6).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.35%, cao hơn 29.1% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 4.0.0 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| vantage6 PyPI | < 4.0.0
| 4.0.0
|
| vantage6 | < 4.0.0
| 4.0.0
|
Mô tả
When a collaboration is deleted in vantage6, the linked resources (such as tasks from that collaboration) are not properly deleted.
This is partly to manage data properly, but also to prevent a potential (but unlikely) side-effect, where if a collaboration with id=10 is deleted, and subsequently a new collaboration is created with id=10, the authenticated users in that collaboration could potentially see results of the deleted collaboration in some cases, resulting in information disclosure.
Mô tả của NVD
vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources (such as tasks from that collaboration) should be deleted. This is partly to manage data properly, but also to prevent a potential (but unlikely) side-effect that affects versions prior to 4.0.0, where if a collaboration with id=10 is deleted, and subsequently a new collaboration is created with id=10, the authenticated users in that collaboration could potentially see results of the deleted collaboration in some cases. Version 4.0.0 contains a patch for this issue. There are no known workarounds.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí