medium5.3
CVE-2023-41646
Buttercup allows attackers to obtain the hash of the master password
Impact
Buttercup allows attackers to obtain the hash of the master password for the password manager via accessing the file /vaults.json/. This affects the Buttercup app up to version 2.20.3.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | buttercup | >= 2.20.3, < 7.4.0 | 7.4.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Perrymitchell | Buttercup | Version 2.20.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://buttercup.pw/
- https://github.com/tristao-marinho/CVE-2023-41646/
- https://github.com/advisories/GHSA-7cwq-p8cr-h9qg
- https://nvd.nist.gov/vuln/detail/CVE-2023-41646
- https://github.com/buttercup/buttercup-core/issues/336
- https://github.com/buttercup/buttercup-core/commit/77fbcdfe4caf57486a3c83c07fc6d36bb0e1d3e1