CVE-2024-5206

A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.

CVSS v3 4.7 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/scikit-learn/scikit-learn/commit/70ca21f106b603b611da73012c9ade7cd8e438b8	Patch
https://huntr.com/bounties/14bc0917-a85b-4106-a170-d09d5191517c	Third Party Advisory
https://github.com/scikit-learn/scikit-learn/commit/70ca21f106b603b611da73012c9ade7cd8e438b8	Patch
https://huntr.com/bounties/14bc0917-a85b-4106-a170-d09d5191517c	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:scikit-learn:scikit-learn:*:*:*:*:*:python:*:*

History

No history.

Information

Published : 2024-06-06 19:16

Updated : 2024-11-21 09:47

NVD link : CVE-2024-5206

Mitre link : CVE-2024-5206

CVE.ORG link : CVE-2024-5206

JSON object : View

Products Affected

scikit-learn

scikit-learn

CWE

CWE-921

Storage of Sensitive Data in a Mechanism without Access Control

CWE-922

Insecure Storage of Sensitive Information

{"id": "CVE-2024-5206", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.0}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.0}]}, "published": "2024-06-06T19:16:06.363", "references": [{"url": "https://github.com/scikit-learn/scikit-learn/commit/70ca21f106b603b611da73012c9ade7cd8e438b8", "tags": ["Patch"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/14bc0917-a85b-4106-a170-d09d5191517c", "tags": ["Third Party Advisory"], "source": "security@huntr.dev"}, {"url": "https://github.com/scikit-learn/scikit-learn/commit/70ca21f106b603b611da73012c9ade7cd8e438b8", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://huntr.com/bounties/14bc0917-a85b-4106-a170-d09d5191517c", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-921"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-922"}]}], "descriptions": [{"lang": "en", "value": "A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad de fuga de datos confidenciales en TfidfVectorizer de scikit-learn, espec\u00edficamente en versiones hasta la 1.4.1.post1 incluida, que se solucion\u00f3 en la versi\u00f3n 1.5.0. La vulnerabilidad surge del almacenamiento inesperado de todos los tokens presentes en los datos de entrenamiento dentro del atributo `stop_words_`, en lugar de almacenar solo el subconjunto de tokens necesarios para que funcione la t\u00e9cnica TF-IDF. Este comportamiento conduce a una posible fuga de informaci\u00f3n confidencial, ya que el atributo `stop_words_` podr\u00eda contener tokens que deb\u00edan descartarse y no almacenarse, como contrase\u00f1as o claves. El impacto de esta vulnerabilidad var\u00eda seg\u00fan la naturaleza de los datos que procesa el vectorizador."}], "lastModified": "2024-11-21T09:47:11.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:scikit-learn:scikit-learn:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "C27C3BF2-FC82-4EC8-908F-61EB93677AC1", "versionEndExcluding": "1.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}