PT-2024-25426 · Passbolt · Passbolt Browser Extension

Ruben Meeuwissen · Published 2024-04-26 · Updated 2025-06-18 · CVE-2024-33669

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Passbolt Browser Extension versions prior to 4.6.2

Description An issue in the Passbolt Browser Extension results in an information leak. As a user types a password, multiple requests are sent to HaveIBeenPwned, allowing an attacker who can observe these HTTPS queries to the Pwned Password API to more easily brute force manually typed passwords.

Recommendations For versions prior to 4.6.2, update to version 4.6.2 or later to resolve the issue. As a temporary workaround, consider disabling the password checking feature that sends requests to HaveIBeenPwned until a patch is applied. Restrict access to sensitive information and use additional security measures to protect against brute force attacks.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-33669

GHSA-XFQ4-78J7-V594

Affected Products

Passbolt Browser Extension

References · 12

• 🔥 https://blog.quarkslab.com/passbolt-a-bold-use-of-haveibeenpwned.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-33669 · Security Note
• https://osv.dev/vulnerability/GHSA-xfq4-78j7-v594 · Vendor Advisory
• https://help.passbolt.com/incidents/pwned-password-service-information-leak · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-33669 · Vendor Advisory
• https://github.com/passbolt/passbolt_browser_extension · Note
• https://t.me/cvenotify/126103 · Telegram Post
• https://passbolt.com/security/more · Note
• https://haveibeenpwned.com · Note
• https://passbolt.com/incidents/pwned-password-service-information-leak · Note
• https://t.me/cvenotify/78076 · Telegram Post
• https://passbolt.com · Note