VulnerabilityAnalyzed
CVE-2024-33669
It can send multiple requests to HaveIBeenPwned while a password is being typed, which results in an information leak.
MEDIUM 6.8EPSS 0.64%
Does this matter?
Lower severity and a low EPSS score (0.64%). Track it; it rarely justifies an emergency change on its own.
Description
An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned while a password is being typed, which results in an information leak. This allows an attacker capable of observing Passbolt's HTTPS queries to the Pwned Password API to more easily brute force passwords that are manually typed by the user.
- CVSS 3.1
- 6.8 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
- EPSS
- 0.64% probability · 49th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- passbolt/passbolt browser extension
- Source
- cve@mitre.org
References
- https://blog.quarkslab.com/passbolt-a-bold-use-of-haveibeenpwned.htmlExploit, Third Party Advisory
- https://haveibeenpwned.comProduct
- https://help.passbolt.com/incidents/pwned-password-service-information-leakIssue Tracking, Vendor Advisory
- https://www.passbolt.comProduct
- https://www.passbolt.com/security/moreProduct
- https://blog.quarkslab.com/passbolt-a-bold-use-of-haveibeenpwned.htmlExploit, Third Party Advisory
- https://haveibeenpwned.comProduct
- https://help.passbolt.com/incidents/pwned-password-service-information-leakIssue Tracking, Vendor Advisory
- https://www.passbolt.comProduct
- https://www.passbolt.com/security/moreProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.