CVE-2023-28635

CVSS 3.1 Score 5.4 of 10 (medium)

Details

Published Oct 11, 2023
Updated: Oct 17, 2023
CWE ID 863

Summary

CVE-2023-28635 is a vulnerability affecting the vantage6 privacy preserving federated learning infrastructure. Prior to version 4.0.0, malicious users can exploit this vulnerability by creating resources with integers as names to gain unauthorized access to restricted resources. For example, if an attacker creates a username with the same value as a user ID that is allowed to run tasks, they would be able to run algorithms they are not authorized for. This vulnerability can be remediated by checking that resource names always start with a character when they are created or modified. The potential danger of this vulnerability lies in unauthorized access to sensitive resources and potential misuse of privileged functionalities within the affected products.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-28635 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options