CVEvulnerability

CVE-2023-22738

6.5 MEDIUM Published 2023-03-01 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-03-01
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-281

Description

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organizations is currently possible. It may lead to unintended access: if a user from organization A is accidentally assigned to organization B, they will retain their permissions and therefore might be able to access stuff they should not be allowed to access. This issue is patched in version 3.8.0.

Affected configurations

• vantage6 vantage6 (< 3.6.1) • vantage6 vantage6 (>= 3.7.0 <= 3.7.3) • vantage6 vantage6 3.8.0

Related

Weakness · CWE (1)

  • CWE-281 Improper Preservation of Permissions weakness

References