{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-32969", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-04-22T15:14:59.165Z", "datePublished": "2024-05-23T08:22:57.564Z", "dateUpdated": "2024-08-02T02:27:53.367Z"}, "containers": {"cna": {"title": "vantage6 collaboration admins can extend their influence by expanding the collaboration", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/vantage6/vantage6/security/advisories/GHSA-99r4-cjp4-3hmx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/vantage6/vantage6/security/advisories/GHSA-99r4-cjp4-3hmx"}, {"name": "https://github.com/vantage6/vantage6/commit/27f4ee3fade5f4cbcf3e60899c9a2a91145e0b56", "tags": ["x_refsource_MISC"], "url": "https://github.com/vantage6/vantage6/commit/27f4ee3fade5f4cbcf3e60899c9a2a91145e0b56"}], "affected": [{"vendor": "vantage6", "product": "vantage6", "versions": [{"version": "< 4.5.0rc3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-05-23T08:22:57.564Z"}, "descriptions": [{"lang": "en", "value": "vantage6 is an open-source infrastructure for privacy preserving analysis. Collaboration administrators can add extra organizations to their collaboration that can extend their influence. For example, organizations that they include can then create new users for which they know the passwords, and use that to read task results of other collaborations that that organization is involved in. This is only relatively trusted users - with access to manage a collaboration - are able to do this, which reduces the impact. This vulnerability was patched in version 4.5.0rc3.\n"}], "source": {"advisory": "GHSA-99r4-cjp4-3hmx", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-32969", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-23T15:35:32.312152Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:50:23.345Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:27:53.367Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/vantage6/vantage6/security/advisories/GHSA-99r4-cjp4-3hmx", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/vantage6/vantage6/security/advisories/GHSA-99r4-cjp4-3hmx"}, {"name": "https://github.com/vantage6/vantage6/commit/27f4ee3fade5f4cbcf3e60899c9a2a91145e0b56", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/vantage6/vantage6/commit/27f4ee3fade5f4cbcf3e60899c9a2a91145e0b56"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/vantage6/vantage6/security/advisories/GHSA-99r4-cjp4-3hmx", "name": "https://github.com/vantage6/vantage6/security/advisories/GHSA-99r4-cjp4-3hmx", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/vantage6/vantage6/commit/27f4ee3fade5f4cbcf3e60899c9a2a91145e0b56", "name": "https://github.com/vantage6/vantage6/commit/27f4ee3fade5f4cbcf3e60899c9a2a91145e0b56", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:27:53.367Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-32969", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-23T15:35:32.312152Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:25.716Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "vantage6 collaboration admins can extend their influence by expanding the collaboration", "source": {"advisory": "GHSA-99r4-cjp4-3hmx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "vantage6", "product": "vantage6", "versions": [{"status": "affected", "version": "< 4.5.0rc3"}]}], "references": [{"url": "https://github.com/vantage6/vantage6/security/advisories/GHSA-99r4-cjp4-3hmx", "name": "https://github.com/vantage6/vantage6/security/advisories/GHSA-99r4-cjp4-3hmx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/vantage6/vantage6/commit/27f4ee3fade5f4cbcf3e60899c9a2a91145e0b56", "name": "https://github.com/vantage6/vantage6/commit/27f4ee3fade5f4cbcf3e60899c9a2a91145e0b56", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "vantage6 is an open-source infrastructure for privacy preserving analysis. Collaboration administrators can add extra organizations to their collaboration that can extend their influence. For example, organizations that they include can then create new users for which they know the passwords, and use that to read task results of other collaborations that that organization is involved in. This is only relatively trusted users - with access to manage a collaboration - are able to do this, which reduces the impact. This vulnerability was patched in version 4.5.0rc3.\n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-05-23T08:22:57.564Z"}}}, "cveMetadata": {"cveId": "CVE-2024-32969", "state": "PUBLISHED", "dateUpdated": "2024-08-02T02:27:53.367Z", "dateReserved": "2024-04-22T15:14:59.165Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-05-23T08:22:57.564Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "vantage6 is an open-source infrastructure for privacy preserving analysis. Collaboration administrators can add extra organizations to their collaboration that can extend their influence. For example, organizations that they include can then create new users for which they know the passwords, and use that to read task results of other collaborations that that organization is involved in. This is only relatively trusted users - with access to manage a collaboration - are able to do this, which reduces the impact. This vulnerability was patched in version 4.5.0rc3.\n"}, {"lang": "es", "value": "vantage6 es una infraestructura de c\u00f3digo abierto para an\u00e1lisis de preservaci\u00f3n de la privacidad. Los administradores de colaboraci\u00f3n pueden agregar organizaciones adicionales a su colaboraci\u00f3n que puedan ampliar su influencia. Por ejemplo, las organizaciones que incluyen pueden crear nuevos usuarios cuyas contrase\u00f1as conocen y usarlas para leer los resultados de tareas de otras colaboraciones en las que participa esa organizaci\u00f3n. Estos son solo usuarios relativamente confiables, con acceso para administrar una colaboraci\u00f3n. son capaces de hacer esto, lo que reduce el impacto. Esta vulnerabilidad fue parcheada en la versi\u00f3n 4.5.0rc3."}], "id": "CVE-2024-32969", "lastModified": "2024-05-24T01:15:30.977", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-05-23T09:15:09.350", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/vantage6/vantage6/commit/27f4ee3fade5f4cbcf3e60899c9a2a91145e0b56"}, {"source": "security-advisories@github.com", "url": "https://github.com/vantage6/vantage6/security/advisories/GHSA-99r4-cjp4-3hmx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}