GitHub Advisoryadvisory · PyPI
GHSA-gc57-xhh5-m94r Improper Access Control in vantage6
MEDIUM
Official page ↗
- Aliases
- CVE-2023-41882
- Ecosystem
- PyPI
- Packages
- vantage6
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-284
- Reviewed
- 2023-10-13
Affected packages
• PyPI vantage6: < 4.0.0 → fixed in 4.0.0
Description
Impact
The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, currently it is only checked if the user has permission to view the collaboration.
Patches
No
Workarounds
None
References
None
For more information
If you have any questions or comments about this advisory:
• Email us at [email protected]
Related
Alias · CVE (1)
- CVE-2023-41882 vantage6 is privacy preserving federated learning infrastructure. vulnerability
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- https://github.com/vantage6/vantage6/security/advisories/GHSA-gc57-xhh5-m94r web
- https://nvd.nist.gov/vuln/detail/CVE-2023-41882 advisory
- https://github.com/vantage6/vantage6/pull/711 web
- https://github.com/vantage6/vantage6/commit/86564e103cbac5238ce2fe392e3357e0e8c20220 web
- https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2023-201.yaml web
- https://github.com/vantage6/vantage6 package
- https://github.com/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400 web