CVE-2022-39228
Observable Response Discrepancy in vantage6
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This issue has been fixed in version 3.8.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Observable Response Discrepancy in vantage6
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This issue has been fixed in version 3.8.0.
- Record
CVE-2022-39228- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-204, CWE-203
- Updated
- 2026-11-02
EUVDEUVD-2023-0260
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This issue has been fixed in version 3.8.0.
- Record
EUVD-2023-0260- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-36gx-9q6h-g429
vantage6 vulnerable to Observable Response Discrepancy
Impact
We are incorporating the password policies listed in https://github.com/vantage6/vantage6/issues/59. One measure is that we don't let the user know in case of wrong username/password combination if the username actually exists, to prevent that bots can guess usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This way you could still find out which usernames exist.
Patches
Update to 3.8.0+
Workarounds
No
References
https://github.com/vantage6/vantage6/issues/59
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected]
- Record
GHSA-36gx-9q6h-g429- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-203, CWE-204
- Updated
- 2026-11-02
NVD
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This issue has been fixed in version 3.8.0.
- Record
CVE-2022-39228- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-203, CWE-204
- Updated
- 2026-11-02
OSV
Observable Response Discrepancy in vantage6
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This issue has been fixed in version 3.8.0.
- Record
CVE-2022-39228- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-203, CWE-204
- Updated
- 2026-11-02
OSVGHSA-36gx-9q6h-g429
vantage6 vulnerable to Observable Response Discrepancy
Impact
We are incorporating the password policies listed in https://github.com/vantage6/vantage6/issues/59. One measure is that we don't let the user know in case of wrong username/password combination if the username actually exists, to prevent that bots can guess usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This way you could still find out which usernames exist.
Patches
Update to 3.8.0+
Workarounds
No
References
https://github.com/vantage6/vantage6/issues/59
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected]
- Record
GHSA-36gx-9q6h-g429- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-203, CWE-204
- Updated
- 2026-11-02
OSVPYSEC-2023-313
Withdrawn as duplicate of PYSEC-2023-52 vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This issue has been fixed in version 3.8.0.
- Record
PYSEC-2023-313- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
OSVPYSEC-2023-52 No score
vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This issue has been fixed in version 3.8.0.
- Record
PYSEC-2023-52- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vantage6PyPI |
before 3.8.0 | 3.8.0 |
vantage6PyPI |
before 3.8.0, plus listed versions 0.0.00.0.0b00.0.0b10.0.0b31.0.0 Show 45 moreShow less1.0.0a11.0.0a21.0.0b101.0.0b111.0.0b121.0.0b131.0.0b141.0.0b21.0.0b31.0.0b41.0.0b51.0.0b61.0.0b71.0.0b81.0.0b91.1.01.1.0rc11.1.0rc21.2.01.2.11.2.21.2.31.2.3.post22.0.02.0.0.post12.0.0a12.0.0a22.0.0a32.0.1rc12.0.1rc22.1.02.1.0rc12.1.12.2.02.2.0b12.2.0b22.2.0b32.2.0b42.2.12.2.102.2.112.2.122.2.22.2.32.2.4 |
3.8.0 |
vantage6PyPI |
3.3.3 up to 3.8.0, plus listed versions 3.3.43.3.53.3.63.3.73.3.7a2 Show 39 moreShow less3.3.7a33.3.8a13.3.8a23.3.8a43.3.8a53.3.8a63.3.8a73.3.8a83.4.03.4.0a13.4.0a23.4.0a33.4.0a63.4.13.4.1a03.4.1a13.4.1a23.4.1a33.4.23.4.2a03.4.33.5.03.5.0rc13.5.0rc23.5.0rc33.5.13.5.23.6.03.6.13.6.1rc13.6.1rc23.6.1rc33.7.03.7.0rc13.7.0rc23.7.13.7.23.7.33.8.0rc3 |
3.8.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-39228 is a medium vulnerability (CVSS 5.3) in Vantage6, published February 28, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. Fixed in vantage6 3.8.0.
References
github.com/vantage6/vantage6/security/advisories/GHSA-36gx-9q6h-g429
nvd.nist.gov/vuln/detail/CVE-2022-39228
Left out here: 100 versions. The JSON record has them.