Password Disable: Vulnerability in Mobile Apps Allows Saved Passwords to be Accessed
CVE-2024-45833

6.5MEDIUM

Key Information:

Vendor

Mattermost
Status
Mattermost
Vendor
CVE Published:
16 September 2024

What is CVE-2024-45833?

Mattermost Mobile Apps versions <=2.18.0 fail to disable autocomplete during login while typing the password and visible password is selected, which allows the password to get saved in the dictionary when the user has Swiftkey as the default keyboard, the masking is off and the password contains a special character..

Affected Version(s)

Mattermost 0 <= 2.18.0

Mattermost 2.19.0

References

https://mattermost.com/security-updates

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

@lolcabanon
.