PT-2019-12997 · Bcn Quark · Bcn Quark Quarking Password Manager

Gionreale · Published 2019-06-24 · Updated 2020-08-24 · CVE-2019-12880

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions BCN Quark Quarking Password Manager version 3.1.84

Description The issue is caused by allowing * within web accessible resources, which leads to a clickjacking vulnerability. An attacker can exploit this to cause significant harm.

Recommendations For BCN Quark Quarking Password Manager version 3.1.84, consider restricting access to web accessible resources to prevent clickjacking attacks until a patch is available.

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2019-12880

Affected Products

Bcn Quark Quarking Password Manager

References · 5

• https://chrome.google.com/webstore/detail/quarking-password-manager/gfkmpfajamepgekgohcdnjogmeamcdmm?hl=en · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12880 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12880 · Security Note
• http://packetstormsecurity.com/files/153405/Quarking-Password-Manager-3.1.84-Clickjacking.html · Note
• http://seclists.org/fulldisclosure/2019/Jun/31 · Note