GHSA-4946-85pr-fvxh — medium GitHub Advisory (CVE-2024-23823) in pip/vantage6

Description

The vantage6 server has no restrictions on CORS settings. It should be possible for people to set the allowed origins of the server.

The impact is limited because v6 does not use session cookies

No

No

Score	Percentile
0.20%	41.51%

Base score	Version	Severity	Vector
4.2	3.1	—	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:R) A real person has to do something—click, install, enable—otherwise it doesn’t land. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:N) Service keeps running; no real outage angle.

Type	Value
GHSA	GHSA-4946-85pr-fvxh ↗
CVE	CVE-2024-23823 ↗

CWE id	Name
CWE-863	Incorrect Authorization
CWE-942	Permissive Cross-domain Security Policy with Untrusted Domains

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
pip	vantage6	<= 4.2.2	4.3.0	—