ByteOS Network

NVD Vulnerability Details :

CVE-2024-21671

Analyzed

Source-security-advisories@github.com

Published At-30 Jan, 2024 | 16:15

Updated At-08 Feb, 2024 | 16:42

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks. Version 4.2.0 patches this vulnerability.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	3.7	LOW	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Secondary	3.1	3.7	LOW	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CPE Matches

vantage6>>vantage6>>Versions before 4.2.0(exclusive)

cpe:2.3:a:vantage6:vantage6:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-203	Primary	nvd@nist.gov
CWE-208	Secondary	security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/vantage6/vantage6/commit/389f416c445da4f2438c72f34c3b1084485c4e30	security-advisories@github.com	Patch
https://github.com/vantage6/vantage6/security/advisories/GHSA-45gq-q4xh-cp53	security-advisories@github.com	Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History