CVE-2024-22193

Katalog CVE

CVSS 4.3 · Medium EPSS 0,26%

Kerentanan Insecure Storage of Sensitive Information pada vantage6. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. Therefore, a user may accidentally create a task with sensitive input data that will then be stored unencrypted in a database. Users should ensure they set the encryption setting correctly. This vulnerability is patched in 4.2.0.

Rincian

Terbit di NVD

30 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-922: Insecure Storage of Sensitive Information

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vantage6/vantage6/security/advisories/GHSA-rjmv-52mp-gjrr advisory vendor
• https://github.com/vantage6/vantage6/commit/6383283733b81abfcacfec7538dc4dc882e98074 patch