CVE-2023-28635 json
Defining resource name as integer in vantage6 may give unintended access
published 2023-10-11 3 y ago modified 2026-09-10 1 mo ago also GHSA-7x94-6g2m-3hp2 , PYSEC-2023-198 , PYSEC-2026-2006 , EUVD-2023-0255
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 43%
- public exploits
- 0
- none known
Summary
vantage6 is privacy preserving federated learning infrastructure. Prior to version 4.0.0, malicious users may try to get access to resources they are not allowed to see, by creating resources with integers as names. One example where this is a risk, is when users define which users are allowed to run algorithms on their node. This may be defined by username or user id. Now, for example, if user id 13 is allowed to run tasks, and an attacker creates a username with username '13', they would be wrongly allowed to run an algorithm. There may also be other places in the code where such a mixup of resource ID or name leads to issues. Version 4.0.0 contains a patch for this issue. The best solution is to check when resources are created or modified, that the resource name always starts with a character.
Patch / fix
- pypi vantage6 4.0.0
- pypi vantage6-node 4.0.0
- vantage6 vantage6 4.0.0
- github.com/vantage6/vantage6@aacfc24 commit
- github.com/vantage6/vantage6#744 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.50% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| OSV | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | vantage6 | <4.0.0 |
4.0.0 |
| pypi | vantage6-node | <4.0.0 |
4.0.0 |
Affected products
- vantage6 vantage6
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/vantage6/vantage6/pull/744
web, patch
-
github.com
/vantage6/vantage6/commit/aacfc24548cbf168579d2e13b2ddaf8ded715d36
web
-
github.com
/vantage6/vantage6/security/advisories/GHSA-7x94-6g2m-3hp2
web, vendor-advisory, advisory
-
github.com
/vantage6/vantage6/blob/0682c4288f43fee5bcc72dc448cdd99bd7e57f76/docs/release_notes.rst#400
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2023-28635
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/vantage6-node/PYSEC-2023-198.yaml
web
-
github.com
/vantage6/vantage6
package
-
pypi.org
/project/vantage6
package
-
github.com
/advisories/GHSA-7x94-6g2m-3hp2
advisory
Sources
- CVE List CVE-2023-28635
- GitHub Advisory GHSA-7x94-6g2m-3hp2
- NVD CVE-2023-28635
- OSV PYSEC-2026-2006
- OSV PYSEC-2023-198
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.