CVE-2023-40580

Freighter is a Stellar chrome extension. It may be possible for a malicious website to access the recovery mnemonic phrase when the Freighter wallet is unlocked. This vulnerability impacts access control to the mnemonic recovery phrase. This issue was patched in version 5.3.1.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/stellar/freighter/commit/81f78ba008c41ce631a3d0f9e4449f4bbd90baee	Patch
https://github.com/stellar/freighter/pull/948	Patch
https://github.com/stellar/freighter/security/advisories/GHSA-vqr6-hwg2-775w	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:stellar:freighter:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-08-25 20:15

Updated : 2023-08-31 17:38

NVD link : CVE-2023-40580

Mitre link : CVE-2023-40580

CVE.ORG link : CVE-2023-40580

JSON object : View

Products Affected

stellar

freighter

CWE

NVD-CWE-noinfo CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2023-40580", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2023-08-25T20:15:08.913", "references": [{"url": "https://github.com/stellar/freighter/commit/81f78ba008c41ce631a3d0f9e4449f4bbd90baee", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/stellar/freighter/pull/948", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/stellar/freighter/security/advisories/GHSA-vqr6-hwg2-775w", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Freighter is a Stellar chrome extension. It may be possible for a malicious website to access the recovery mnemonic phrase when the Freighter wallet is unlocked. This vulnerability impacts access control to the mnemonic recovery phrase. This issue was patched in version 5.3.1."}, {"lang": "es", "value": "Freighter es una extensi\u00f3n de Stellar para Chrome. Puede ser posible que un sitio web malicioso acceda a la frase mnemot\u00e9cnica de recuperaci\u00f3n cuando se desbloquea el monedero de Freighter. Esta vulnerabilidad afecta al control de acceso a la frase mnemot\u00e9cnica de recuperaci\u00f3n. Este problema fue parcheado en la versi\u00f3n 5.3.1."}], "lastModified": "2023-08-31T17:38:54.047", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:stellar:freighter:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3846CA30-6154-4221-BDA9-6E4B9CF3837E", "versionEndExcluding": "5.3.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}