PT-2023-27518 · Freighter · Freighter

C0X41Lch0X41 · Published 2023-08-25 · Updated 2025-04-23 · CVE-2023-40580

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Freighter versions prior to 5.3.1

Description The issue impacts access control to the mnemonic recovery phrase, potentially allowing a malicious website to access the recovery mnemonic phrase when the Freighter wallet is unlocked.

Recommendations For versions prior to 5.3.1, update to version 5.3.1 to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-40580

GHSA-VQR6-HWG2-775W

Affected Products

Freighter

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40580.json · Exploit
• https://github.com/stellar/freighter/commit/81f78ba008c41ce631a3d0f9e4449f4bbd90baee · Patch
• https://github.com/stellar/freighter/security/advisories/GHSA-vqr6-hwg2-775w · Patch
• https://github.com/stellar/freighter/pull/948 · Patch
• https://osv.dev/vulnerability/CVE-2023-40580 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40580 · Security Note
• https://t.me/cibsecurity/69223 · Telegram Post
• https://twitter.com/syedaquib77/status/1915143894653702383 · Twitter Post
• https://twitter.com/syedaquib77/status/1912173750319255916 · Twitter Post