CVE-2023-33187

Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates type="password" inputs...

CVE-2023-33187 highlight vulnerable to cleartext transmission of sensitive information

Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates type="password" inputs...

CVE-2023-33187 highlight vulnerable to cleartext transmission of sensitive information

Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates type="password" inputs...

CVE-2023-33187

CVE-2023-33187 affects Highlight (highlight.run) where passwords could be recorded when a password input is changed to type="text" via a Show Password control. The root cause is that switching input types could bypass obfuscation, allowing password values to be captured. The issue has been fixed ...