| عنوان | Buttercup Password Manager Buttercup Browser Extension <=v0.14.2 Improper Access Control – Sensitive Data Exposure (CWE-284 / CWE |
|---|
| الوصف | The Buttercup Browser Extension through 0.14.2 allows any visited web page to craft hidden form elements and send synthetic mouse events that force the extension to search its vault and autofill credentials. An attacker who controls page JavaScript can capture the plaintext password, leading to high confidentiality impact. Fixed in v1.0.1.
PoC here: https://github.com/buttercup/buttercup-browser-extension/issues/92#issuecomment-372991430 |
|---|
| المصدر | ⚠️ https://github.com/buttercup/buttercup-browser-extension/issues/92 |
|---|
| المستخدم | lukechilds (UID 88472) |
|---|
| ارسال | 04/08/2025 01:48 PM (1 سنة منذ) |
|---|
| الاعتدال | 13/08/2025 06:23 PM (9 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 319969 [Buttercup buttercup-browser-extension حتى 0.14.2 Vault تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|