Chainvantage6PyPI:vantage6
vantage6: related fixes (2023–2025)
6 CVEs over 4 generations, 11 Oct 2023 to 12 Jun 2025.
Family tree
Left to right by publication date.Oldest first. Select a CVE to open it.- CVE-2023-2863511 Oct 2023 First in the chain
- CVE-2023-4188211 Oct 2023 related to CVE-2023-28635
- CVE-2024-2167130 Jan 2024 related to CVE-2023-28635
- CVE-2024-2477014 Mar 2024 related to CVE-2024-21671related to CVE-2023-28635
- CVE-2024-3296923 May 2024 related to CVE-2023-28635related to CVE-2023-41882and 1 more
- CVE-2025-4386312 Jun 2025 related to CVE-2023-28635related to CVE-2024-24770and 1 more
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
CVEs in this family
Table view of the tree| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2023-28635 | 11 Oct 2023 | Defining resource name as integer in vantage6 may give unintended access · fixed in 4.0.0 | First in chain | 12.4 |
| CVE-2023-41882 | 11 Oct 2023 | vantage6 Improper Access Control vulnerability · fixed in 4.0.0 | CVE-2023-28635 · related · Medium | 12.3 |
| CVE-2024-21671 | 30 Jan 2024 | vantage6 username timing attack · fixed in 4.2.0 | CVE-2023-28635 · related · Medium | 9.5 |
| CVE-2024-24770 | 14 Mar 2024 | Username timing attack on recover password/MFA token in vantage6 · fixed in 4.3.0 | CVE-2024-21671 · related · High | 10.5 |
| CVE-2024-32969 | 23 May 2024 | vantage6 collaboration admins can extend their influence by expanding the collaboration · fixed in 4.5.0rc3 | CVE-2023-28635 · related · Medium | 6.9 |
| CVE-2025-43863 | 12 Jun 2025 | vantage6 lacks brute-force protection on change password functionality · fixed in 4.11.0 | CVE-2023-28635 · related · Medium | 9.3 |