CVEvulnerability
CVE-2021-23827
5.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-02-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-312
Description
Keybase Desktop Client before 5.6.0 on Windows and macOS, and before 5.6.1 on Linux, allows an attacker to obtain potentially sensitive media (such as private pictures) in the Cache and uploadtemps directories. It fails to effectively clear cached pictures, even after deletion via normal methodology within the client, or by utilizing the "Explode message/Explode now" functionality. Local filesystem access is needed by the attacker.
Affected configurations
• keybase keybase (< 5.6.0)
• keybase keybase (< 5.6.1)
Related
Weakness · CWE (1)
- CWE-312 Cleartext Storage of Sensitive Information weakness
References
- https://github.com/keybase/client/releases Release Notes, Third Party Advisory
- https://hackerone.com/reports/1074930 Exploit, Issue Tracking, Third Party Advisory
- https://johnjhacking.com/blog/cve-2021-23827/ Exploit, Third Party Advisory
- https://github.com/keybase/client/releases Release Notes, Third Party Advisory
- https://hackerone.com/reports/1074930 Exploit, Issue Tracking, Third Party Advisory
- https://johnjhacking.com/blog/cve-2021-23827/ Exploit, Third Party Advisory