CVE-2023-41646 Buttercup allows attackers to obtain the hash of the master password
Attackers can obtain the master password hash by accessing a local file, potentially leading to credential compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-41646?
CVE-2023-41646 is a medium-severity vulnerability in n/a, published on 7 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Buttercup v2.20.3 allows attackers to obtain the hash of the master password for the password manager via accessing the file /vaults.json/
Weakness: CWE-916
Which versions are affected by CVE-2023-41646?
2 open source packages ship an affected version, including buttercup. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
buttercup npm | From 2.20.3 | 7.4.0 |
buttercup npm | From 2.20.3 | 7.4.0 |
Products include Perrymitchell Buttercup.
How do I fix CVE-2023-41646?
Upgrade buttercup to 7.4.0 or later.
Is CVE-2023-41646 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-41646 exists.
Sources
Also known as GHSA-7cwq-p8cr-h9qg.