GitHub Advisoryadvisory · npm, PyPI

GHSA-g777-crp9-m27g Apprite CLI makes Use of Hard-coded Credentials

MEDIUM Published 2024-01-09 Modified 2024-09-13 Official page ↗
Aliases
CVE-2023-50974
Ecosystem
npm, PyPI
Packages
appwrite-cli, appwrite
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-798
Reviewed
2024-01-12

Affected packages

• npm appwrite-cli: < 3.0.0 → fixed in 3.0.0 • PyPI appwrite: < 3.0.0 → fixed in 3.0.0

Description

In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials.

Related

Alias · CVE (1)

  • CVE-2023-50974 In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json… vulnerability

Weakness · CWE (1)

  • CWE-798 Use of Hard-coded Credentials weakness

References