« Volver al listado

CVE-2024-32969

Estado: AplazadaBaja (2.7)—

vantage6 is an open-source infrastructure for privacy preserving analysis. Collaboration administrators can add extra organizations to their collaboration that can extend their influence. For example, organizations that they include can then create new users for which they know the passwords, and use that to read task results of other collaborations that that organization is involved in. This is only relatively trusted users - with access to manage a collaboration - are able to do this, which reduces the impact. This vulnerability was patched in version 4.5.0rc3.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Vantage6 — Vantage6AI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-32969",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-32969",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-23T15:35:32.312152Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 2.7,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "vantage6",
          "product": "vantage6",
          "versions": [
            {
              "status": "affected",
              "version": "< 4.5.0rc3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-05-23T09:15:09.350",
  "references": [
    {
      "url": "https://github.com/vantage6/vantage6/commit/27f4ee3fade5f4cbcf3e60899c9a2a91145e0b56",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vantage6/vantage6/security/advisories/GHSA-99r4-cjp4-3hmx",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vantage6/vantage6/commit/27f4ee3fade5f4cbcf3e60899c9a2a91145e0b56",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/vantage6/vantage6/security/advisories/GHSA-99r4-cjp4-3hmx",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "vantage6 is an open-source infrastructure for privacy preserving analysis. Collaboration administrators can add extra organizations to their collaboration that can extend their influence. For example, organizations that they include can then create new users for which they know the passwords, and use that to read task results of other collaborations that that organization is involved in.  This is only relatively trusted users - with access to manage a collaboration - are able to do this, which reduces the impact. This vulnerability was patched in version 4.5.0rc3.\n"
    },
    {
      "lang": "es",
      "value": "vantage6 es una infraestructura de código abierto para análisis de preservación de la privacidad. Los administradores de colaboración pueden agregar organizaciones adicionales a su colaboración que puedan ampliar su influencia. Por ejemplo, las organizaciones que incluyen pueden crear nuevos usuarios cuyas contraseñas conocen y usarlas para leer los resultados de tareas de otras colaboraciones en las que participa esa organización. Estos son solo usuarios relativamente confiables, con acceso para administrar una colaboración. son capaces de hacer esto, lo que reduce el impacto. Esta vulnerabilidad fue parcheada en la versión 4.5.0rc3."
    }
  ],
  "lastModified": "2026-06-17T07:30:47.507",
  "sourceIdentifier": "security-advisories@github.com"
}