Vulnerabilities > CVE-2024-21671 - Information Exposure Through Discrepancy vulnerability in Vantage6

CVSS 3.7 - LOW

Attack vector

NETWORK

Attack complexity

HIGH

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

NONE

Availability impact

NONE

network

high complexity

vantage6

CWE-203

NVD

Published: 2024-01-30

Updated: 2024-02-08

Summary

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks. Version 4.2.0 patches this vulnerability.

Vulnerable Configurations

Part	Description	Count
Application	Vantage6 Vantage6 Vantage6 - Vantage6 Vantage6 0.0.0 Vantage6 Vantage6 2.3.5 Vantage6 Vantage6 3.3.0 Vantage6 Vantage6 3.3.3 Vantage6 Vantage6 3.3.8 Vantage6 Vantage6 3.4.0 Vantage6 Vantage6 3.4.1 Vantage6 Vantage6 3.4.2 Vantage6 Vantage6 3.5.0 Vantage6 Vantage6 3.6.1 Vantage6 Vantage6 3.7.0 Vantage6 Vantage6 3.8.0 Vantage6 Vantage6 3.8.1 Vantage6 Vantage6 3.8.2 Vantage6 Vantage6 3.8.3 Vantage6 Vantage6 3.8.4 Vantage6 Vantage6 3.8.5 Vantage6 Vantage6 3.8.6 Vantage6 Vantage6 3.8.7 Vantage6 Vantage6 3.8.8 Vantage6 Vantage6 3.9.0 Vantage6 Vantage6 3.10.0 Vantage6 Vantage6 3.10.1 Vantage6 Vantage6 3.10.2 Vantage6 Vantage6 3.10.3 Vantage6 Vantage6 3.10.4 Vantage6 Vantage6 3.11.0 Vantage6 Vantage6 3.11.1 Vantage6 Vantage6 4.0.0 Vantage6 Vantage6 4.0.1 Vantage6 Vantage6 4.0.2 Vantage6 Vantage6 4.0.3 Vantage6 Vantage6 4.1.0 Vantage6 Vantage6 4.1.1 Vantage6 Vantage6 4.1.2	100

Common Weakness Enumeration (CWE)

CWE-203 - Information Exposure Through Discrepancy

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References