Vulnerability Details CVE-2024-24770
vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. Much like GHSA-45gq-q4xh-cp53, it is possible to find which usernames exist in vantage6 by calling the API routes `/recover/lost` and `/2fa/lost`. These routes send emails to users if they have lost their password or MFA token. This issue has been addressed in commit `aecfd6d0e` and is expected to ship in subsequent releases. Users are advised to upgrade as soon as a new release is available. There are no known workarounds for this vulnerability.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 42.1%
CVSS Severity
CVSS v3 Score 5.3
References
- https://github.com/vantage6/vantage6/commit/aecfd6d0e83165a41a60ebd52d2287b0217be26b
- https://github.com/vantage6/vantage6/security/advisories/GHSA-45gq-q4xh-cp53
- https://github.com/vantage6/vantage6/security/advisories/GHSA-5h3x-6gwf-73jm
- https://github.com/vantage6/vantage6/commit/aecfd6d0e83165a41a60ebd52d2287b0217be26b
- https://github.com/vantage6/vantage6/security/advisories/GHSA-45gq-q4xh-cp53
- https://github.com/vantage6/vantage6/security/advisories/GHSA-5h3x-6gwf-73jm
Products affected by CVE-2024-24770
-
cpe:2.3:a:vantage6:vantage6:-
-
cpe:2.3:a:vantage6:vantage6:0.0.0
-
cpe:2.3:a:vantage6:vantage6:2.3.5
-
cpe:2.3:a:vantage6:vantage6:3.10.0
-
cpe:2.3:a:vantage6:vantage6:3.10.1
-
cpe:2.3:a:vantage6:vantage6:3.10.2
-
cpe:2.3:a:vantage6:vantage6:3.10.3
-
cpe:2.3:a:vantage6:vantage6:3.10.4
-
cpe:2.3:a:vantage6:vantage6:3.11.0
-
cpe:2.3:a:vantage6:vantage6:3.11.1
-
cpe:2.3:a:vantage6:vantage6:3.3.0
-
cpe:2.3:a:vantage6:vantage6:3.3.3
-
cpe:2.3:a:vantage6:vantage6:3.3.8
-
cpe:2.3:a:vantage6:vantage6:3.4.0
-
cpe:2.3:a:vantage6:vantage6:3.4.1
-
cpe:2.3:a:vantage6:vantage6:3.4.2
-
cpe:2.3:a:vantage6:vantage6:3.5.0
-
cpe:2.3:a:vantage6:vantage6:3.6.1
-
cpe:2.3:a:vantage6:vantage6:3.7.0
-
cpe:2.3:a:vantage6:vantage6:3.8.0
-
cpe:2.3:a:vantage6:vantage6:3.8.1
-
cpe:2.3:a:vantage6:vantage6:3.8.2
-
cpe:2.3:a:vantage6:vantage6:3.8.3
-
cpe:2.3:a:vantage6:vantage6:3.8.4
-
cpe:2.3:a:vantage6:vantage6:3.8.5
-
cpe:2.3:a:vantage6:vantage6:3.8.6
-
cpe:2.3:a:vantage6:vantage6:3.8.7
-
cpe:2.3:a:vantage6:vantage6:3.8.8
-
cpe:2.3:a:vantage6:vantage6:3.9.0
-
cpe:2.3:a:vantage6:vantage6:4.0.0
-
cpe:2.3:a:vantage6:vantage6:4.0.1
-
cpe:2.3:a:vantage6:vantage6:4.0.2
-
cpe:2.3:a:vantage6:vantage6:4.0.3
-
cpe:2.3:a:vantage6:vantage6:4.1.0
-
cpe:2.3:a:vantage6:vantage6:4.1.1
-
cpe:2.3:a:vantage6:vantage6:4.1.2
-
cpe:2.3:a:vantage6:vantage6:4.1.3
-
cpe:2.3:a:vantage6:vantage6:4.2.0