Lucene search

[email protected]NVD:CVE-2022-32969

HistoryJun 29, 2022 - 3:15 p.m.

CVE-2022-32969

2022-06-2915:15:07

CWE-281

[email protected]

web.nvd.nist.gov

metamask

vulnerability

bip39

mnemonic

input field

firefox

chromium

security issue

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

45.2%

JSON

MetaMask before 10.11.3 might allow an attacker to access a user’s secret recovery phrase because an input field is used for a BIP39 mnemonic, and Firefox and Chromium save such fields to disk in order to support the Restore Session feature, aka the Demonic issue.

Affected configurations

Nvd

Node

metamaskmetamaskRange<10.11.3

VendorProductVersionCPE
metamaskmetamask*cpe:2.3:a:metamask:metamask:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
metamask	metamask	*	cpe:2.3:a:metamask:metamask::::::::

References

github.com/MetaMask/metamask-extension/compare/v10.11.2...v10.11.3

halborn.com/disclosures/demonic-vulnerability/

halborn.com/halborn-discovers-critical-vulnerability-affecting-crypto-wallet-browser-extensions/

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

45.2%

JSON

Related for NVD:CVE-2022-32969

prion1 osv1 cvelist1 cve1