// For flags

CVE-2024-22193

vantage6 unencrypted task can be created in encrypted collaboration

Severity Score

4.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. Therefore, a user may accidentally create a task with sensitive input data that will then be stored unencrypted in a database. Users should ensure they set the encryption setting correctly. This vulnerability is patched in 4.2.0.

La tecnología vantage6 permite gestionar e implementar tecnologías que mejoran la privacidad, como el Federated Learning (FL) y la Multi-Party Computation (MPC). No se comprueba si la entrada está cifrada si se crea una tarea en una colaboración cifrada. Por lo tanto, un usuario puede crear accidentalmente una tarea con datos de entrada confidenciales que luego se almacenarán sin cifrar en una base de datos. Los usuarios deben asegurarse de configurar correctamente la configuración de cifrado. Esta vulnerabilidad está parcheada en 4.2.0.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2024-01-08 CVE Reserved
  • 2024-01-30 CVE Published
  • 2024-02-09 EPSS Updated
  • 2024-08-01 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-922: Insecure Storage of Sensitive Information
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Vantage6
Search vendor "Vantage6"
Vantage6
Search vendor "Vantage6" for product "Vantage6"
< 4.2.0
Search vendor "Vantage6" for product "Vantage6" and version " < 4.2.0"
-
Affected