CWE-315
AllowedCleartext Storage of Sensitive Information in a Cookie
Abstraction: Variant · Status: Draft
The product stores sensitive information in cleartext in a cookie.
12 vulnerabilities reference this CWE, most recent first.
GHSA-G9MC-4FCM-JRR6
Vulnerability from github – Published: 2022-05-24 19:12 – Updated: 2022-05-24 19:12Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's credentials to the PEPPERL+FUCHS WirelessHART-Gateway 3.0.9.
{
"affected": [],
"aliases": [
"CVE-2021-34564"
],
"database_specific": {
"cwe_ids": [
"CWE-315"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-31T11:15:00Z",
"severity": "MODERATE"
},
"details": "Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user\u0027s credentials to the PEPPERL+FUCHS WirelessHART-Gateway 3.0.9.",
"id": "GHSA-g9mc-4fcm-jrr6",
"modified": "2022-05-24T19:12:38Z",
"published": "2022-05-24T19:12:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34564"
},
{
"type": "WEB",
"url": "https://cert.vde.com/en-us/advisories/vde-2021-027"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-J4G3-3Q8X-JXQP
Vulnerability from github – Published: 2023-12-08 15:38 – Updated: 2023-12-08 15:38Impact
When used to pull source code from a private repository using a Personal Access Token (PAT), some versions of dbt-core write a URL with the PAT in plaintext to the package-lock.yml file.
Patches
The bug has been fixed in dbt-core v1.7.3.
Mitigations
Remove any git URLs with plaintext secrets from package-lock.yml file(s) on servers, workstations, or in source control. Rotate any tokens that have been written to version-controlled files.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "dbt-core"
},
"ranges": [
{
"events": [
{
"introduced": "1.7.0"
},
{
"fixed": "1.7.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-315"
],
"github_reviewed": true,
"github_reviewed_at": "2023-12-08T15:38:37Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "### Impact\n\nWhen used to pull source code from a private repository using a Personal Access Token (PAT), some versions of dbt-core write a URL with the PAT in plaintext to the `package-lock.yml` file.\n\n### Patches\n\nThe bug has been fixed in [dbt-core v1.7.3](https://github.com/dbt-labs/dbt-core/releases/tag/v1.7.3).\n\n### Mitigations\n\nRemove any git URLs with plaintext secrets from `package-lock.yml` file(s) on servers, workstations, or in source control. Rotate any tokens that have been written to version-controlled files.",
"id": "GHSA-j4g3-3q8x-jxqp",
"modified": "2023-12-08T15:38:37Z",
"published": "2023-12-08T15:38:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/dbt-labs/dbt-core/security/advisories/GHSA-j4g3-3q8x-jxqp"
},
{
"type": "WEB",
"url": "https://github.com/dbt-labs/dbt-core/commit/09f5bb3dcffeda7a60ad2b22c2891f237628ecd1"
},
{
"type": "PACKAGE",
"url": "https://github.com/dbt-labs/dbt-core"
},
{
"type": "WEB",
"url": "https://github.com/dbt-labs/dbt-core/releases/tag/v1.7.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "dbt-core\u0027s secret env vars written to package-lock.json in plaintext"
}
No mitigation information available for this CWE.
CAPEC-31: Accessing/Intercepting/Modifying HTTP Cookies
This attack relies on the use of HTTP Cookies to store credentials, state information and other critical data on client systems. There are several different forms of this attack. The first form of this attack involves accessing HTTP Cookies to mine for potentially sensitive data contained therein. The second form involves intercepting this data as it is transmitted from client to server. This intercepted information is then used by the adversary to impersonate the remote user/session. The third form is when the cookie's content is modified by the adversary before it is sent back to the server. Here the adversary seeks to convince the target server to operate on this falsified information.
CAPEC-37: Retrieve Embedded Sensitive Data
An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.
CAPEC-39: Manipulating Opaque Client-based Data Tokens
In circumstances where an application holds important data client-side in tokens (cookies, URLs, data files, and so forth) that data can be manipulated. If client or server-side application components reinterpret that data as authentication tokens or data (such as store item pricing or wallet information) then even opaquely manipulating that data may bear fruit for an Attacker. In this pattern an attacker undermines the assumption that client side tokens have been adequately protected from tampering through use of encryption or obfuscation.
CAPEC-74: Manipulating State
The adversary modifies state information maintained by the target software or causes a state transition in hardware. If successful, the target will use this tainted state and execute in an unintended manner.
State management is an important function within a software application. User state maintained by the application can include usernames, payment information, browsing history as well as application-specific contents such as items in a shopping cart. Manipulating user state can be employed by an adversary to elevate privilege, conduct fraudulent transactions or otherwise modify the flow of the application to derive certain benefits.
If there is a hardware logic error in a finite state machine, the adversary can use this to put the system in an undefined state which could cause a denial of service or exposure of secure data.