CVE-2020-25459 Information disclosure in n/a
Attackers can read sensitive information during machine learning joint modeling in WeBank FATE due to an issue in the sync_tree function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-25459?
CVE-2020-25459 is a high-severity vulnerability in n/a, published on 16 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in function sync_tree in hetero_decision_tree_guest.py in WeBank FATE (Federated AI Technology Enabler) 0.1 through 1.4.2 allows attackers to read sensitive information during the training process of machine learning joint modeling.
Weakness: CWE-668
Which versions are affected by CVE-2020-25459?
It affects 1 product.
Products include Webank Federated Ai Technology Enabler.
How do I fix CVE-2020-25459?
Upgrade to a fixed version.
Is CVE-2020-25459 being exploited?
There is no known exploitation of CVE-2020-25459 in the wild and no public exploit code.
Sources
Also known as GHSA-72c2-p2mr-mqr3, MGASA-2021-0049.