CVE-2023-28635

Summary

CVE-2023-28635 affects the vantage6 privacy-preserving federated learning infrastructure prior to version 4.0.0. Malicious users could bypass access controls by creating resources with integer names, such as usernames or user ids. For instance, if user id 13 is granted algorithm execution rights, an attacker could create a username '13' to unlawfully run algorithms. The vulnerability exists in various locations within the code where resource IDs and names are mixed up. Version 4.0.0 includes a patch to address this issue, and the recommended solution is to ensure that resource names begin with a character to prevent potential conflicts with IDs.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.