CVE-2022-32969 Information disclosure in n/a
Attackers can recover user secret phrases because browsers save mnemonic input fields to disk, compromising wallet security.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-32969?
CVE-2022-32969 is a medium-severity vulnerability in n/a, published on 29 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MetaMask before 10.11.3 might allow an attacker to access a user's secret recovery phrase because an input field is used for a BIP39 mnemonic, and Firefox and Chromium save such fields to disk in order to support the Restore Session feature, aka the Demonic issue.
Weakness: CWE-281
Which versions are affected by CVE-2022-32969?
It affects 1 product.
Products include Metamask Metamask.
How do I fix CVE-2022-32969?
No fix has been published for CVE-2022-32969 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-32969 being exploited?
There is no known exploitation of CVE-2022-32969 in the wild and no public exploit code.
Sources
Also known as GHSA-h9g9-j2c8-v8gv.