PT-2025-33514 · Unknown · Buttercup Buttercup-Browser-Extension

Published 2025-08-16 · Updated 2025-08-24 · CVE-2017-20199

Positive Technologies · (AI Summary)

CVSS v2.0

2.6

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions:

Buttercup buttercup-browser-extension versions up to 0.14.2

Description:

A vulnerability exists in Buttercup buttercup-browser-extension up to version 0.14.2 due to improper access controls. The issue is remotely exploitable, but the complexity of an attack is high and exploitation appears to be difficult. The exploit has been publicly disclosed. This vulnerability affects products that are no longer supported by the maintainer.

Recommendations:

Upgrade to version 1.0.1 to address this issue.

Fix

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

CVE-2017-20199

Affected Products

Buttercup Buttercup-Browser-Extension

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2017-20199 · Security Note
• https://osv.dev/vulnerability/CVE-2017-20199 · Vendor Advisory
• https://github.com/buttercup/buttercup-browser-extension/releases/tag/v1.0.1 · Note
• https://github.com/buttercup/buttercup-browser-extension/issues/92 · Note
• https://github.com/buttercup/buttercup-browser-extension/issues/92#issuecomment-372991430 · Note
• https://github.com/buttercup/buttercup-browser-extension/issues/92#issuecomment-358449755 · Note
• https://github.com/buttercup/buttercup-browser-extension/pull/89 · Note
• https://vuldb.com/?ctiid.319969 · Note
• https://t.me/cveNotify/133274 · Telegram Post
• https://t.me/cveNotify/132556 · Telegram Post
• https://vuldb.com/?id.319969 · Note
• https://vuldb.com/?submit.628170 · Note
• https://t.me/CVEtracker/30161 · Telegram Post