CVE-2024-32969 vantage6 collaboration admins can extend their influence by expanding the collaboration
Collaboration administrators can add organizations to expand influence, allowing them to read task results from other collaborations via created users.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-32969?
CVE-2024-32969 is a low-severity vulnerability in vantage6, published on 23 May 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
vantage6 is an open-source infrastructure for privacy preserving analysis. Collaboration administrators can add extra organizations to their collaboration that can extend their influence. For example, organizations that they include can then create new users for which they know the passwords, and use that to read task results of other collaborations that that organization is involved in. This is only relatively trusted users - with access to manage a collaboration - are able to do this, which reduces the impact. This vulnerability was patched in version 4.5.0rc3.
Weakness: CWE-284
Which versions are affected by CVE-2024-32969?
3 open source packages ship an affected version, including vantage6.
| Package | Affected | Fixed in |
|---|---|---|
vantage6 PyPI | All versions | 4.5.0rc3 |
vantage6 PyPI | All versions | 4.5.0rc3 |
vantage6 PyPI | All versions | 4.5.0rc3 |
How do I fix CVE-2024-32969?
Upgrade vantage6 to 4.5.0rc3 or later.
Is CVE-2024-32969 being exploited?
There is no known exploitation of CVE-2024-32969 in the wild and no public exploit code.
Sources
Also known as GHSA-99r4-cjp4-3hmx, PYSEC-2026-2007.