Lucene search

GitHub_MCVELIST:CVE-2023-40580

HistoryAug 25, 2023 - 7:51 p.m.

CVE-2023-40580 Freighter mnemonic phrase may be accessed by Javascript through a private API

2023-08-2519:51:17

CWE-200

GitHub_M

www.cve.org

freighter

mnemonic phrase

vulnerability

patched

version 5.3.1

access control

stellar

chrome extension

private api

javascript

recovery phrase

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

8.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.3%

JSON

Freighter is a Stellar chrome extension. It may be possible for a malicious website to access the recovery mnemonic phrase when the Freighter wallet is unlocked. This vulnerability impacts access control to the mnemonic recovery phrase. This issue was patched in version 5.3.1.

CNA Affected

[
  {
    "vendor": "stellar",
    "product": "freighter",
    "versions": [
      {
        "version": "< 5.3.1",
        "status": "affected"
      }
    ]
  }
]

References

github.com/stellar/freighter/commit/81f78ba008c41ce631a3d0f9e4449f4bbd90baee

github.com/stellar/freighter/pull/948

github.com/stellar/freighter/security/advisories/GHSA-vqr6-hwg2-775w

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

8.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.3%

JSON

Related for CVELIST:CVE-2023-40580