Lucene search

GitHub Advisory DatabaseGHSA-7CWQ-P8CR-H9QG

HistorySep 08, 2023 - 12:31 a.m.

Buttercup allows attackers to obtain the hash of the master password

2023-09-0800:31:02

CWE-916

GitHub Advisory Database

github.com

buttercup

vulnerability

master password

hash

leak

file access

version 2.20.3

software

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

30.3%

JSON

Buttercup allows attackers to obtain the hash of the master password for the password manager via accessing the file /vaults.json/.

This affects the Buttercup app up to version 2.20.3.

Affected configurations

Vulners

Node

buttercup_wfmbuttercupRange2.20.3–7.4.0

VendorProductVersionCPE
buttercup_wfmbuttercup*cpe:2.3:a:buttercup_wfm:buttercup:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
buttercup_wfm	buttercup	*	cpe:2.3:a:buttercup_wfm:buttercup::::::::

References

buttercup.pw/

github.com/advisories/GHSA-7cwq-p8cr-h9qg

github.com/buttercup/buttercup-core/commit/77fbcdfe4caf57486a3c83c07fc6d36bb0e1d3e1

github.com/buttercup/buttercup-core/issues/336

github.com/tristao-marinho/CVE-2023-41646/

nvd.nist.gov/vuln/detail/CVE-2023-41646

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

30.3%

JSON

Related for GHSA-7CWQ-P8CR-H9QG