PT-2024-40259 · Passbolt · Passbolt

Published 2024-05-20 · Updated 2024-05-20

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Passbolt (affected versions not specified)

Description: The issue concerns the /auth/verify.json endpoint, which returns a JSON containing the cookies sent in the request. This could allow an attacker who exploits an XSS vulnerability to retrieve the session cookies of a legitimate user, effectively granting them access to sensitive information without requiring user interaction. The impact of this issue is considered low, but it requires the exploitation of an XSS vulnerability that has yet to be found.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

GHSA-F5PP-PMQ8-GP46

Affected Products

Passbolt

References · 5

• https://osv.dev/vulnerability/GHSA-f5pp-pmq8-gp46 · Vendor Advisory
• https://github.com/passbolt/passbolt_api · Note
• https://github.com/passbolt/passbolt_api/commit/fbf99fed4b60db5fec97b58a2251a04bb42c1b15 · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/passbolt/passbolt_api/2019-02-11-2.yaml · Note
• https://passbolt.com/incidents/20190211_multiple_vulnerabilities · Note