PT-2018-16248 · Quicken · Quicken Deluxe 2018 For Mac

Published 2018-12-03 · Updated 2022-12-03 · CVE-2018-3854

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Quicken Deluxe 2018 for Mac version 5.2.2

Description An information disclosure issue exists in the password protection functionality. A specially crafted sqlite3 request can remove the password protection, allowing access and modification of data without the password. The attacker must have access to the password-protected files to exploit this issue.

Recommendations For Quicken Deluxe 2018 for Mac version 5.2.2, consider restricting access to the password-protected files until a fix is available. As a temporary workaround, avoid using the sqlite3 request functionality that can trigger this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-3854

Affected Products

Quicken Deluxe 2018 For Mac

References · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0537 · Exploit
• https://osv.dev/vulnerability/CVE-2018-3854 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-3854 · Security Note