PT-2014-3742 · Starbucks · Starbucks

Daniel Wood · Publicado 2014-01-28 · Atualizado 2018-10-09 · CVE-2014-0647

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Starbucks version 2.6.1

Description The issue concerns the storage of sensitive information in plaintext within a log file, specifically the Crashlytics log file located at /Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog. This allows attackers to discover usernames, passwords, and e-mail addresses by reading the session.clslog file.

Recommendations For version 2.6.1, consider restricting access to the Crashlytics log file to minimize the risk of exploitation. As a temporary workaround, avoid using the application until a patch is available that properly secures sensitive information.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2014-0647

Produtos afetados

Starbucks

Referências · 10

• http://seclists.org/fulldisclosure/2014/Jan/123 · Nota
• https://itunes.apple.com/us/app/starbucks/id331177714?mt=8 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90412 · Nota
• http://zdnet.com/starbucks-fixes-ios-app-bugs-7000025323 · Nota
• http://seclists.org/fulldisclosure/2014/Jan/64 · Nota
• http://securityfocus.com/bid/64942 · Nota
• http://osvdb.org/102514 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-0647 · Nota de Segurança
• http://zdnet.com/the-starbucks-bug-not-as-awful-as-reported-7000025269 · Nota
• http://securityfocus.com/archive/1/530756/100/0/threaded · Nota