CVE-2024-22193
mediumPriorität · verfolgen · 17EPSS 0.003 · 17. PerzentilEUUSEPSS · bewertet 2026-10-27
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. Therefore, a user may accidentally create a task with sensitive input data that will then be stored unencrypted in a database. Users should ensure they set the encryption setting correctly. This vulnerability is patched in 4.2.0.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 3.5–4.3
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (4)
Betroffene Produkte und Versionsbereiche.
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-rjmv-52mp-gjrrvantage6 may create unencrypted tasks in encrypted collaboration2024-01-30ghsa · osvUS
### Impact There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. Therefore, a user may accidentally create a task with sensitive input data that will then be stored unencrypted in a database. ### Workarounds This is not an issue with the normal workflow, only if e.g. a user with the python client sets encryption to the wrong value.
- PYSEC-2024-322024-01-30vendor · osvUS
The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. Therefore, a user may accidentally create a task with sensitive input data that will then be stored unencrypted in a database. Users should ensure they set the encryption setting correctly. This vulnerability is patched in 4.2.0.
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (7)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2024-22193/cnnvd
- https://github.com/vantage6/vantage6/commit/6383283733b81abfcacfec7538dc4dc882e98074cnnvd
- https://github.com/vantage6/vantage6/security/advisories/GHSA-rjmv-52mp-gjrrcnnvd
- https://github.com/vantage6/vantage6/commit/6383283733b81abfcacfec7538dc4dc882e98074enisa_euvd
- https://github.com/vantage6/vantage6/security/advisories/GHSA-rjmv-52mp-gjrrenisa_euvd
- https://github.com/vantage6/vantage6/commit/6383283733b81abfcacfec7538dc4dc882e98074Patchnvd
- https://github.com/vantage6/vantage6/security/advisories/GHSA-rjmv-52mp-gjrrVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan