GHSA-7cwq-p8cr-h9qg

Buttercup allows attackers to obtain the hash of the master password

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-41646

Packages

Ecosystem	Package	Affected	Fixed in
npm	buttercup	>= 2.20.3, < 7.4.0	7.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

Buttercup allows attackers to obtain the hash of the master password for the password manager via accessing the file /vaults.json/. This affects the Buttercup app up to version 2.20.3.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-41646 advisory
https://github.com/buttercup/buttercup-core/issues/336 web
https://github.com/buttercup/buttercup-core/commit/77fbcdfe4caf57486a3c83c07fc6d36bb0e1d3e1 web
https://buttercup.pw web
https://github.com/buttercup/buttercup-core package
https://github.com/tristao-marinho/CVE-2023-41646 web