Refresh tokens do not expire in Vantage6
CVE-2023-23929

8.8HIGH

Key Information:

Vendor

Vantage6

Status
Vantage6
Vendor
CVE Published:
4 March 2023

What is CVE-2023-23929?

The Vantage6 federated learning infrastructure has a significant security flaw where the refresh token is valid indefinitely. This design oversight poses a risk as the refresh token should ideally be limited to a validity period of 24-48 hours to mitigate threats of unauthorized access. An update has been released in version 3.8.0 to address this issue, enhancing the overall security framework of the application.

Affected Version(s)

vantage6 < 3.8.0

References

https://github.com/vantage6/vantage6/security/advisories/...
x_refsource_CONFIRM
https://github.com/vantage6/vantage6/commit/48ebfca42359e...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.