PT-2019-12677 · Dropbox · Dropbox

Publicado 2019-07-08 · Atualizado 2021-07-21 · CVE-2019-12171

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dropbox desktop application version 71.4.108.0

Description The issue concerns the storage of cleartext credentials in memory by Dropbox.exe and QtWebEngineProcess.exe upon successful login or new account creation. These credentials are not securely freed in the running process.

Recommendations For version 71.4.108.0, consider updating to a newer version that securely handles credentials in memory, ensuring that sensitive information is properly cleared after use.

Exploit

Correção

Insufficiently Protected Credentials

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-522

CWE-312

Identificadores relacionados

CVE-2019-12171

Produtos afetados

Dropbox

Referências · 5

• 🔥 https://drive.google.com/open?id=1msz6pb08crPC0VT7s_Z_KTsKm9CbLJEXNsmRwzoNLy8 · Exploit
• 🔥 https://drive.google.com/open?id=1DCGurwRTu0HsUpTglVR0jgItZNqqDm_5 · Exploit
• https://t.me/cvenotify/300 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-12171 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12171 · Aviso do Fabricante