CVE-2024-21649CWE-94

Remote code execution

High · published January 30, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
69.5
In the wild
Unconfirmed
What it is

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Prior to 4.2.0, authenticated users could inject code into algorithm environment variables, resulting in remote code execution. This vulnerability is patched in 4.2.0.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01266 · 69.5th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-01-30T15:33Z
EPSS history
Timeline
  • 30 JAN 15:33Z
    Remote code execution
    cvelistv5