vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. If attacker gets access to an authenticated session, they can try to brute-force the user password by using the change password functionality: they can call that route infinitely which will return the message that password is wrong until it is correct. This vulnerability is fixed in 4.11.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
References
History
Thu, 12 Jun 2025 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 12 Jun 2025 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. If attacker gets access to an authenticated session, they can try to brute-force the user password by using the change password functionality: they can call that route infinitely which will return the message that password is wrong until it is correct. This vulnerability is fixed in 4.11. | |
| Title | vantage6 lacks brute-force protection on change password functionality | |
| Weaknesses | CWE-307 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2025-06-12T17:29:57.047Z
Updated: 2025-06-12T17:54:44.017Z
Reserved: 2025-04-17T20:07:08.556Z
Link: CVE-2025-43863
Vulnrichment
Updated: 2025-06-12T17:54:34.712Z
NVD
Status : Awaiting Analysis
Published: 2025-06-12T18:15:20.533
Modified: 2025-06-16T12:32:18.840
Link: CVE-2025-43863
Redhat
No data.