An issue was discovered in the stashcat app through 3.9.2 for macOS, Windows, Android, iOS, and possibly other platforms. It stores the client_key, the device_id, and the public key for end-to-end encryption in cleartext, enabling an attacker (by copying or having access to the local storage database file) to login to the system from any other computer, and get unlimited access to all data in the users's context.
References
Link | Resource |
---|---|
http://www.jvanlaak.de/stashcat.html | Third Party Advisory |
http://www.jvanlaak.de/stashcat_CWE_312_200527.pdf | Third Party Advisory |
http://www.jvanlaak.de/stashcat.html | Third Party Advisory |
http://www.jvanlaak.de/stashcat_CWE_312_200527.pdf | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 05:01
Type | Values Removed | Values Added |
---|---|---|
References | () http://www.jvanlaak.de/stashcat.html - Third Party Advisory | |
References | () http://www.jvanlaak.de/stashcat_CWE_312_200527.pdf - Third Party Advisory |
Information
Published : 2020-06-17 17:15
Updated : 2024-11-21 05:01
NVD link : CVE-2020-13637
Mitre link : CVE-2020-13637
CVE.ORG link : CVE-2020-13637
JSON object : View
Products Affected
heinekingmedia
- stashcat
CWE
CWE-312
Cleartext Storage of Sensitive Information