CVE-2024-33669 Passbolt Browser Extension leaks password information
An attacker observing network traffic can infer typed passwords via excessive API calls, enabling easier brute-force attacks against Passbolt users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-33669?
CVE-2024-33669 is a medium-severity vulnerability in n/a, published on 26 Apr 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned while a password is being typed, which results in an information leak. This allows an attacker capable of observing Passbolt's HTTPS queries to the Pwned Password API to more easily brute force passwords that are manually typed by the user.
Weakness: CWE-200
Which versions are affected by CVE-2024-33669?
2 open source packages ship an affected version, including passbolt-browser-extension. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
passbolt-browser-extension npm | All versions | 4.6.2 |
passbolt-browser-extension npm | All versions | 4.6.2 |
Products include Passbolt Passbolt Browser Extension.
How do I fix CVE-2024-33669?
Upgrade passbolt-browser-extension to 4.6.2 or later.
Is CVE-2024-33669 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-33669 exists.
Sources
Also known as GHSA-xfq4-78j7-v594.