CVE-2022-39228

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This issue has been fixed in version 3.8.0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-203 CWE-204

Affected software

Vendor	Product	Versions
vantage6	vantage6	< 3.8.0

References

https://github.com/vantage6/vantage6/commit/ab4381c35d24add06f75d5a8a284321f7a340bd2Patch
https://github.com/vantage6/vantage6/issues/59Issue Tracking, Vendor Advisory
https://github.com/vantage6/vantage6/pull/281Patch, Vendor Advisory
https://github.com/vantage6/vantage6/security/advisories/GHSA-36gx-9q6h-g429Vendor Advisory
https://github.com/vantage6/vantage6/commit/ab4381c35d24add06f75d5a8a284321f7a340bd2Patch
https://github.com/vantage6/vantage6/issues/59Issue Tracking, Vendor Advisory
https://github.com/vantage6/vantage6/pull/281Patch, Vendor Advisory
https://github.com/vantage6/vantage6/security/advisories/GHSA-36gx-9q6h-g429Vendor Advisory

Timeline

Published: Mar 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-392294.3Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to bl CVE-2022-39234.3The ActiveCampaign for WooCommerce WordPress plugin before 1.9.8 does not have authorisation check when cleaning up its error logs via an AJ CVE-2022-392306.5fhir-works-on-aws-authz-smart is an implementation of the authorization interface from the FHIR Works interface. Versions 3.1.1 and 3.1.2 ar CVE-2022-392313.7Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.16, or fro CVE-2022-392324.3Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote ca CVE-2022-392335.4Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions 12.9.99.228 and above, pr CVE-2022-392348.8GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service CVE-2022-392365.3Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can CVE-2022-392379.8syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/inte CVE-2022-392388.8Arvados is an open source platform for managing and analyzing biomedical big data. In versions prior to 2.4.3, when using Portable Authentic CVE-2022-392395.4netlify-ipx is an on-Demand image optimization for Netlify using ipx. In versions prior to 1.2.3, an attacker can bypass the source image do CVE-2022-39247.5This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, confi