PT-2014-3742 · Starbucks · Starbucks

Daniel Wood · Published 2014-01-28 · Updated 2018-10-09 · CVE-2014-0647

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Starbucks version 2.6.1

Description The issue concerns the storage of sensitive information in plaintext within a log file, specifically the Crashlytics log file located at /Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog. This allows attackers to discover usernames, passwords, and e-mail addresses by reading the session.clslog file.

Recommendations For version 2.6.1, consider restricting access to the Crashlytics log file to minimize the risk of exploitation. As a temporary workaround, avoid using the application until a patch is available that properly secures sensitive information.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2014-0647

Affected Products

Starbucks

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2014-0647 · Security Note
• http://seclists.org/fulldisclosure/2014/Jan/123 · Note
• https://itunes.apple.com/us/app/starbucks/id331177714?mt=8 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90412 · Note
• http://zdnet.com/starbucks-fixes-ios-app-bugs-7000025323 · Note
• http://seclists.org/fulldisclosure/2014/Jan/64 · Note
• http://securityfocus.com/bid/64942 · Note
• http://osvdb.org/102514 · Note
• http://zdnet.com/the-starbucks-bug-not-as-awful-as-reported-7000025269 · Note
• http://securityfocus.com/archive/1/530756/100/0/threaded · Note