Vulnerability	Vulnerable Version
M Brute Force vantage6-server is a Vantage6 server Affected versions of this package are vulnerable to Brute Force due to a lack of rate limiting on the password change functionality. An attacker who has gained access to an authenticated session can attempt to brute-force the user's password. They can call the change password route an unlimited number of times, allowing them to systematically guess passwords until they find the correct one and compromise the account. How to fix Brute Force? Upgrade `vantage6-server` to version 4.11.0rc2 or higher.	[,4.11.0rc2)
M Insecure Randomness vantage6-server is a Vantage6 server Affected versions of this package are vulnerable to Insecure Randomness via the `configure_flask` function, due to the predictable nature of the auto-generated secret key, an attacker can determine it and forge valid security tokens. This allows them to bypass authentication and gain unauthorized access to the system. How to fix Insecure Randomness? Upgrade `vantage6-server` to version 4.11.0rc2 or higher.	[,4.11.0rc2)

Brute Force

vantage6-server is a Vantage6 server

Affected versions of this package are vulnerable to Brute Force due to a lack of rate limiting on the password change functionality. An attacker who has gained access to an authenticated session can attempt to brute-force the user's password. They can call the change password route an unlimited number of times, allowing them to systematically guess passwords until they find the correct one and compromise the account.

How to fix Brute Force?

Upgrade vantage6-server to version 4.11.0rc2 or higher.

[,4.11.0rc2)

Insecure Randomness

vantage6-server is a Vantage6 server

Affected versions of this package are vulnerable to Insecure Randomness via the configure_flask function, due to the predictable nature of the auto-generated secret key, an attacker can determine it and forge valid security tokens. This allows them to bypass authentication and gain unauthorized access to the system.

How to fix Insecure Randomness?

Upgrade vantage6-server to version 4.11.0rc2 or higher.

[,4.11.0rc2)

Go back to all versions of this package