Products
Passbolt Browser Extension
- before 4.6.2
Source
cve@mitre.org
Tags
CVE-2024-33669 details
Published : April 26, 2024, 1:15 a.m.
Last Modified : April 26, 2024, 12:58 p.m.
Last Modified : April 26, 2024, 12:58 p.m.
Description
An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned while a password is being typed, which results in an information leak. This allows an attacker capable of observing Passbolt's HTTPS queries to the Pwned Password API to more easily brute force passwords that are manually typed by the user.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6.1 | 7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|
CVSS Data
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Base Score
6.1
Exploitability Score
Impact Score
Base Severity
MEDIUM
Vector String : CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
References
| URL | Source |
|---|---|
| https://blog.quarkslab.com/passbolt-a-bold-use-of-haveibeenpwned.html | cve@mitre.org |
| https://haveibeenpwned.com | cve@mitre.org |
| https://help.passbolt.com/incidents/pwned-password-service-information-leak | cve@mitre.org |
| https://www.passbolt.com | cve@mitre.org |
| https://www.passbolt.com/security/more | cve@mitre.org |
This website uses the NVD API, but is not approved or certified by it.