CVEvulnerability
CVE-2024-33669
6.8 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2024-04-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.1 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
- CVSS 3.1 ([email protected])
- 6.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
- Weaknesses
- CWE-200
Description
An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned while a password is being typed, which results in an information leak. This allows an attacker capable of observing Passbolt's HTTPS queries to the Pwned Password API to more easily brute force passwords that are manually typed by the user.
Affected configurations
• passbolt passbolt browser extension (< 4.6.2)
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://blog.quarkslab.com/passbolt-a-bold-use-of-haveibeenpwned.html Exploit, Third Party Advisory
- https://haveibeenpwned.com Product
- https://help.passbolt.com/incidents/pwned-password-service-information-leak Issue Tracking, Vendor Advisory
- https://www.passbolt.com Product
- https://www.passbolt.com/security/more Product
- https://blog.quarkslab.com/passbolt-a-bold-use-of-haveibeenpwned.html Exploit, Third Party Advisory
- https://haveibeenpwned.com Product
- https://help.passbolt.com/incidents/pwned-password-service-information-leak Issue Tracking, Vendor Advisory
- https://www.passbolt.com Product
- https://www.passbolt.com/security/more Product