CVE-2020-25459

CVE-2020-25459 is a high-severity information disclosure vulnerability affecting WeBank FATE (Federated AI Technology Enabler) versions 0.1 through 1.4.2. An attacker can exploit a flaw in the sync_tree function within hetero_decision_tree_guest.py to read sensitive information during the machine learning joint modeling training process. With a CVSS score of 7.5, this vulnerability is easily exploitable over the network without authentication, leading to a high impact on confidentiality. Despite its severity, there is no evidence of active exploitation, publicly available exploit code, or significant community discussion or media coverage.