Cyber Resilience

CVE-2024-5206

Scikit-Learn ≤ 1.5.0

Published
06 June 2024
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 4.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0019 9th percentile
Risk Priority 36 floored blend · peak EPSS

Summary

CVE-2024-5206 is a medium-severity Storage of Sensitive Data in a Mechanism without Access Control (CWE-921) vulnerability in Scikit-Learn Scikit-Learn. Its CVSS base score is 4.7 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as Machine Learning Libraries; in the Privacy and Disclosure risk domain.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within…

more

the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.

CWE(s)

AI Security AnalysisAI

AI Category
Machine Learning Libraries
Risk Domain
Privacy and Disclosure
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
scikit-learn is a core machine learning library, and TfidfVectorizer is a component for text vectorization in ML/NLP pipelines, directly fitting the Machine Learning Libraries category.

Related Threats

MITRE ATT&CK Enterprise Techniques

T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
T1552.004 Private Keys Credential Access
Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials.
T1552.006 Group Policy Preferences Credential Access
Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP).
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
T1552.002 Credentials in Registry Credential Access
Adversaries may search the Registry on compromised systems for insecurely stored credentials.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-41965Shared CWE-921, CWE-922
CVE-2023-2665Shared CWE-921, CWE-922
CVE-2025-46660Shared CWE-922
CVE-2024-46635Shared CWE-922
CVE-2024-23241Shared CWE-922
CVE-2026-7257Shared CWE-922
CVE-2023-34056Shared CWE-922
CVE-2024-37654Shared CWE-922
CVE-2023-37563Shared CWE-922
CVE-2024-26559Shared CWE-922

Affected Assets

scikit-learn
scikit-learn
≤ 1.5.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 4 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

AC-3 directly requires enforcement of access authorizations on system resources including stored data, structurally eliminating storage without access control.

Requires protection of confidentiality/integrity for information at rest, directly addressing insecure storage.

Limits privileges so only authorized accesses to sensitive stored data are permitted.

Associates security attributes with information to support proper access decisions on storage.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 full match
prevents

Defining and enforcing access permissions on storage directly prevents the weakness.

PR.DS-01 mostly match
prevents

Protecting data-at-rest typically requires access controls or encryption on storage mechanisms.

PR.IR-01 partial match
prevents

Logical access protections on environments can reduce exposure of uncontrolled storage.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Access control policy directly requires protection of sensitive data wherever it is stored.

prevents

Granting and reviewing access rights prevents unauthorized access to sensitive data on storage media.

prevents

Information-access-restriction control directly enforces access controls on stored sensitive data.

mitigates

Classification identifies sensitive data that must not be stored without access controls.

mitigates

Storage-media controls mandate physical and logical protection of media holding sensitive information.

mitigates

Deletion reduces exposure but does not address the lack of access control on existing storage.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).

Windows Server 2016 (2 rules)
  • V-224973 The Active Directory Domain Controllers Organizational Unit (OU) object must have the proper access control permissions. prevents CWE-922
  • V-224974 Domain-created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-922
Windows Server 2019 (1 rule)
  • V-205743 Windows Server 2019 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-922

References