PT-2019-12677 · Dropbox · Dropbox

Published 2019-07-08 · Updated 2021-07-21 · CVE-2019-12171

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dropbox desktop application version 71.4.108.0

Description The issue concerns the storage of cleartext credentials in memory by Dropbox.exe and QtWebEngineProcess.exe upon successful login or new account creation. These credentials are not securely freed in the running process.

Recommendations For version 71.4.108.0, consider updating to a newer version that securely handles credentials in memory, ensuring that sensitive information is properly cleared after use.

Exploit

Fix

Insufficiently Protected Credentials

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-522

CWE-312

Related Identifiers

CVE-2019-12171

Affected Products

Dropbox

References · 5

• 🔥 https://drive.google.com/open?id=1msz6pb08crPC0VT7s_Z_KTsKm9CbLJEXNsmRwzoNLy8 · Exploit
• 🔥 https://drive.google.com/open?id=1DCGurwRTu0HsUpTglVR0jgItZNqqDm_5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12171 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12171 · Vendor Advisory
• https://t.me/cvenotify/300 · Telegram Post