CVE-2023-28635

Summary

CVE-2023-28635 is a vulnerability affecting the vantage6 privacy preserving federated learning infrastructure. Prior to version 4.0.0, malicious users can exploit this vulnerability by creating resources with integers as names to gain unauthorized access to restricted resources. For example, if an attacker creates a username with the same value as a user ID that is allowed to run tasks, they would be able to run algorithms they are not authorized for. This vulnerability can be remediated by checking that resource names always start with a character when they are created or modified. The potential danger of this vulnerability lies in unauthorized access to sensitive resources and potential misuse of privileged functionalities within the affected products.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.