Local Information Disclosure in Bitwarden Desktop by Bitwarden
CVE-2023-38840

5.5MEDIUM

Key Information:

Vendor

Bitwarden

Status
Bitwarden
Vendor
CVE Published:
15 August 2023

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2023-38840?

The vulnerability in Bitwarden Desktop allows attackers with local access to exploit the Bitwarden.exe process. This security flaw enables unauthorized retrieval of sensitive user information, including passwords stored within the application. Users of Bitwarden Desktop version 2023.7.0 and earlier are particularly at risk, making immediate updates crucial to safeguard personal and organizational data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

bw-dump
Created by markuta

bw-dump
Created by windingacqui

References

https://redmaple.tech/blogs/2023/extract-bitwarden-vault-...
https://github.com/markuta/bw-dump
https://github.com/bitwarden/desktop/issues/476

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

JSON
.