Vulnerability Description
vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, if an attacker hacks into a vantage6 user's email account, they can 1) reset the password via email and then 2) reset the 2FA token via email. This way they reduce 2FA to 1FA (email access). Note that most email providers require 2FA to access email, so this issue is not very likely to cause issues. Version 5.0.0 fixes the issue. No known workarounds are available.
Related Weaknesses (CWE)
References
- https://github.com/vantage6/vantage6/blob/main/docs/release_notes.rst#500
- https://github.com/vantage6/vantage6/issues/1932
- https://github.com/vantage6/vantage6/security/advisories/GHSA-4c5c-2vc3-x5w2
FAQ
What is CVE-2024-27928?
CVE-2024-27928 is a documented vulnerability. vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, if an attacker hacks into a vantage6 user's email account, they can 1) reset the password via email a...
How severe is CVE-2024-27928?
CVSS scoring is not yet available for CVE-2024-27928. Check NVD for updates.
Is there a patch for CVE-2024-27928?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.