CVE-2024-5206
mediumPriorität · verfolgen · 19EPSS 0.002 · 8. PerzentilDEEUNLUSEPSS · bewertet 2026-10-23
A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (84)
Betroffene Produkte und Versionsbereiche.
- Dell PowerProtect Data Domain Management Centeralle Versionencert_bundDEcpe:/a:dell:powerprotect_data_domain_management_center:-
- Oracle Financial Services Applications 14.7.0.0.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:14.7.0.0.0
- Oracle Financial Services Applications 14.7.0.7.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:14.7.0.7.0
- Oracle Financial Services Applications 2.9.0.0.0-7.0.0.0.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:2.9.0.0.0_-_7.0.0.0.0
- Oracle Financial Services Applications 21.1.0.0.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:21.1.0.0.0
- Oracle Financial Services Applications 22.1.0.0.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:22.1.0.0.0
- Oracle Financial Services Applications 22.2.0.0.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:22.2.0.0.0
- Oracle Financial Services Applications 5.1.0.0.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:5.1.0.0.0
- Oracle Financial Services Applications 6.1.0.0.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:6.1.0.0.0
- Oracle Financial Services Applications 7.0.0.0.0alle Versionencert_bundDEcpe:/a:oracle:financial_services_applications:7.0.0.0.0
Advisories (6)
Hersteller- und Ökosystem-Meldungen dazu.
- NCSC-2025-0127Kwetsbaarheden verholpen in Oracle Financial ServicesNL2025-04-16csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in verschillende Financial Services producten
- WID-SEC-W-2024-1802IBM Business Automation Workflow: Mehrere SchwachstellenDeutsch2024-08-08csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in IBM Business Automation Workflow ausnutzen, um Informationen offenzulegen oder beliebigen Code auszuführen.
- WID-SEC-W-2025-0225Dell PowerProtect Data Domain: Mehrere SchwachstellenDeutsch2025-01-30csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell PowerProtect Data Domain ausnutzen, um erhöhte Rechte zu erlangen, einen Denial-of-Service-Zustand herbeizuführen und einen nicht näher spezifizierten Angriff durchzuführen.
- WID-SEC-W-2025-0819Oracle Financial Services Applications: Mehrere SchwachstellenDeutsch2025-04-15csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Financial Services Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- GHSA-jw8x-6495-233vscikit-learn sensitive data leakage vulnerability2024-06-06ghsa · osvUS
A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.
- PYSEC-2024-1102024-06-06vendor · osvUS
A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (9)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2024-5206/cnnvd
- https://github.com/scikit-learn/scikit-learn/commit/70ca21f106b603b611da73012c9ade7cd8e438b8cnnvd
- https://github.com/scikit-learn/scikit-learn/releases/tag/1.5.0Patchcnnvd
- https://huntr.com/bounties/14bc0917-a85b-4106-a170-d09d5191517ccnnvd
- https://www.oracle.com/security-alerts/cpuapr2025.htmlcnnvd
- https://github.com/scikit-learn/scikit-learn/commit/70ca21f106b603b611da73012c9ade7cd8e438b8enisa_euvd
- https://huntr.com/bounties/14bc0917-a85b-4106-a170-d09d5191517cenisa_euvd
- https://github.com/scikit-learn/scikit-learn/commit/70ca21f106b603b611da73012c9ade7cd8e438b8Patchnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan