Remote code execution

CVE-2024-21649

What is CVE-2024-21649?

The Vantage6 technology facilitates the management and deployment of privacy-enhancing technologies such as Federated Learning (FL) and Multi-Party Computation (MPC). A significant vulnerability exists in versions prior to 4.2.0, where authenticated users can exploit the system by injecting malicious code into algorithm environment variables. This vulnerability allows attackers to achieve remote code execution, potentially compromising system integrity and user data. The issue has been addressed in version 4.2.0, which includes necessary patches to enhance security.

References