A vulnerability has been found in Uniqkey Password Manager 1.14 and classified as problematic. Affected by this vulnerability is some unknown processing. The manipulation with an unknown input leads to a privilege escalation vulnerability (Credentials). The CWE definition for the vulnerability is CWE-255. As an impact it is known to affect confidentiality.

The bug was discovered 04/05/2019. The weakness was shared 01/23/2019 by Gionathan Reale. This vulnerability is known as CVE-2019-10884 since 04/05/2019. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1552 for this issue. The advisory points out:

Uniqkey Password Manager 1.14 contains a vulnerability which fails to recognise the difference between domains and sub-domains. The vulnerability means that passwords saved for example.com will be recommended for usersite.example.com. This could lead to successful phishing campaigns and create a sense of false security.

A public exploit has been developed by Gionathan Reale and been published immediately after the advisory. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 18 days. During that time the estimated underground price was around $0-$5k.

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Productinfo

Vendor

• Uniqkey

Name

• Password Manager

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Comments