CVE-2022-39228 Observable Response Discrepancy in vantage6

2023-03-0116:23:18

CWE-203

CWE-204

GitHub_M

www.cve.org

cve-2022-39228

observable response discrepancy

vantage6

federated learning

username/password

bot protection

account locking

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

40.7%

JSON

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This issue has been fixed in version 3.8.0.

CNA Affected

[
  {
    "vendor": "vantage6",
    "product": "vantage6",
    "versions": [
      {
        "version": "< 3.8.0",
        "status": "affected"
      }
    ]
  }
]