Lucene search

GoogleOSV:CVE-2023-40580

HistoryAug 25, 2023 - 8:15 p.m.

CVE-2023-40580

2023-08-2520:15:08

Google

osv.dev

freighter

chrome extension

vulnerability

recovery phrase

access control

patched

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

28.3%

JSON

Freighter is a Stellar chrome extension. It may be possible for a malicious website to access the recovery mnemonic phrase when the Freighter wallet is unlocked. This vulnerability impacts access control to the mnemonic recovery phrase. This issue was patched in version 5.3.1.

CPENameOperatorVersion
freightereq3.0.1
freightereq2.2.1
freightereq1.0.3-beta
freightereq5.2.2
freightereq1.0.0-rc.0
freightereq2.1.1-beta.2.1.1
freightereq1.1.0
freightereq5.2.5
freightereq2.9.0-beta.0
freightereq1.1.0-rc.0

Name	Operator	Version
freighter	eq	3.0.1
freighter	eq	2.2.1
freighter	eq	1.0.3-beta
freighter	eq	5.2.2
freighter	eq	1.0.0-rc.0
freighter	eq	2.1.1-beta.2.1.1
freighter	eq	1.1.0
freighter	eq	5.2.5
freighter	eq	2.9.0-beta.0
freighter	eq	1.1.0-rc.0

Rows per page:

1-10 of 1071

References

github.com/stellar/freighter/commit/81f78ba008c41ce631a3d0f9e4449f4bbd90baee

github.com/stellar/freighter/pull/948

github.com/stellar/freighter/security/advisories/GHSA-vqr6-hwg2-775w

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

28.3%

JSON

Related for OSV:CVE-2023-40580