medium5.5
CVE-2023-50974
Apprite CLI makes Use of Hard-coded Credentials
Impact
In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | appwrite-cli | < 3.0.0 | 3.0.0 |
| pip | appwrite | >= 0, < 3.0.0 | 3.0.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Appwrite | Command Line Interface | before 3.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://appwrite.io/docs/tooling/command-line/installation
- https://gist.github.com/SkypLabs/72ee00ecfa7d1a3494e2d69a24279c1d
- https://github.com/advisories/GHSA-g777-crp9-m27g
- https://nvd.nist.gov/vuln/detail/CVE-2023-50974
- https://github.com/pypa/advisory-database/tree/main/vulns/appwrite/PYSEC-2024-2.yaml