6.5

CVE-2017-20199

Exploit

Buttercup buttercup-browser-extension Vault access control

A vulnerability was found in Buttercup buttercup-browser-extension up to 0.14.2. Affected by this vulnerability is an unknown functionality of the component Vault Handler. The manipulation results in improper access controls. The attack may be performed from a remote location. A high complexity level is associated with this attack. The exploitation appears to be difficult. The exploit has been made public and could be used. Upgrading to version 1.0.1 addresses this issue. The patch is identified as 89. Upgrading the affected component is recommended. This vulnerability only affects products that are no longer supported by the maintainer.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Buttercup ≫ Buttercup Version < 1.0.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.43% 0.339
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
cna@vuldb.com 1.3 0 0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
cna@vuldb.com 3.1 1.6 1.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
cna@vuldb.com 2.6 4.9 2.9
AV:N/AC:H/Au:N/C:P/I:N/A:N
CWE-266 Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://vuldb.com/?id.319969
Third Party Advisory
VDB Entry
https://vuldb.com/?ctiid.319969
VDB Entry
Permissions Required
https://vuldb.com/?submit.628170
Third Party Advisory
VDB Entry
https://github.com/buttercup/buttercup-browser-extension/issues/92
Issue Tracking
https://github.com/buttercup/buttercup-browser-extension/issues/92#issuecomment-358449755
Issue Tracking
https://github.com/buttercup/buttercup-browser-extension/issues/92#issuecomment-372991430
Issue Tracking
https://github.com/buttercup/buttercup-browser-extension/pull/89
Patch
https://github.com/buttercup/buttercup-browser-extension/releases/tag/v1.0.1
Release Notes