GitHub Advisoryadvisory · PyPI

GHSA-99r4-cjp4-3hmx vantage6 collaboration admins can extend their influence by expanding the collaboration

LOW Published 2024-05-22 Modified 2024-05-23 Official page ↗
Aliases
CVE-2024-32969
Ecosystem
PyPI
Packages
vantage6
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-284
Reviewed
2024-05-22

Affected packages

• PyPI vantage6: < 4.5.0rc3 → fixed in 4.5.0rc3

Description

Impact Collaboration administrators can add extra organizations to their collaboration. When doing that, they extend their influence: for instance, for organizations that they include, they can then create new users for which they know the passwords, and use that to read task results of other collaborations that that organization is involved in. Only relatively trusted users - with access to manage a collaboration - are able to do this, which reduces the impact. Patches No Workarounds No

Related

Alias · CVE (1)

  • CVE-2024-32969 vantage6 is an open-source infrastructure for privacy preserving analysis. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References