CVE-2024-21649

Published: Jan 30, 2024Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Prior to 4.2.0, authenticated users could inject code into algorithm environment variables, resulting in remote code execution. This vulnerability is patched in 4.2.0.

Affected (1)

Products: Vantage6: Vantage6

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Vantage6 Vantage6	Before 4.2.0

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (4)

https://github.com/vantage6/vantage6/commit/eac19db737145d3ca987adf037a454fae0790ddd

Source: security-advisories@github.com

Patch

https://github.com/vantage6/vantage6/security/advisories/GHSA-w9h2-px87-74vx

Source: security-advisories@github.com

Vendor Advisory

https://github.com/vantage6/vantage6/commit/eac19db737145d3ca987adf037a454fae0790ddd

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/vantage6/vantage6/security/advisories/GHSA-w9h2-px87-74vx

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.