PT-2023-24204 · Highlight · Highlight

Vadman97 · Published 2023-05-26 · Updated 2023-06-05 · CVE-2023-33187

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Highlight versions prior to 6.0.0

Description Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript "Show Password" button. This issue arises because the expected behavior of always obfuscating type="password" inputs is not followed when the input type is changed. As a result, customers may unintentionally have their password values recorded when using a "Show Password" button, assuming that switching to type="text" would also prevent recording of the input.

Recommendations For versions prior to 6.0.0, upgrade to version 6.0.0 to ensure that inputs which used to be type="password" continue to be obfuscated even when their type is changed. As a temporary workaround, consider adding the highlight-mask css-class obfuscation to the affected parts of the DOM to prevent unintentional recording of password values.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

AZL-36943

CVE-2023-33187

GHSA-9QPJ-QQ2R-5MCC

Affected Products

Highlight

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33187.json · Exploit
• https://github.com/rrweb-io/rrweb/pull/1184 · Patch
• https://github.com/highlight/highlight/security/advisories/GHSA-9qpj-qq2r-5mcc · Vendor Advisory
• https://osv.dev/vulnerability/AZL-36943 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9qpj-qq2r-5mcc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33187 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33187 · Vendor Advisory
• https://github.com/highlight/highlight · Note