Lucene search

MattermostVULNRICHMENT:CVE-2024-45833

HistorySep 16, 2024 - 6:41 a.m.

CVE-2024-45833 Mobile password gets saved in dictionary under conditions

2024-09-1606:41:47

CWE-693

Mattermost

github.com

mobile

password

dictionary

autocomplete

swiftkey

vulnerability

CVSS3

4.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

AI Score

Confidence

Low

EPSS

0.001

Percentile

18.8%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Mattermost Mobile Apps versions <=2.18.0 fail to disable autocomplete during login while typing the password and visible password is selected, which allows the password to get saved in the dictionary when the user has Swiftkey as the default keyboard, the masking is off and the password contains a special character…

References

mattermost.com/security-updates

CVSS3

4.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

AI Score

Confidence

Low

EPSS

0.001

Percentile

18.8%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-45833