CVE-2022-29868

1Password for Mac 7.2.4 through 7.9.x before 7.9.3 is vulnerable to a process validation bypass. Malicious software running on the same computer can exfiltrate secrets from 1Password provided that 1Password is running and is unlocked. Affected secrets include vault items and derived values used for signing in to 1Password.

CVSS v3 5.5 MEDIUM
CVSS v2.0 2.1 LOW

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://support.1password.com/kb/202204/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:1password:1password:*:*:*:*:*:macos:*:*

History

No history.

Information

Published : 2022-05-09 19:15

Updated : 2024-02-28 19:09

NVD link : CVE-2022-29868

Mitre link : CVE-2022-29868

CVE.ORG link : CVE-2022-29868

JSON object : View

Products Affected

1password

1password

CWE

CWE-312

Cleartext Storage of Sensitive Information

{"id": "CVE-2022-29868", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2022-05-09T19:15:07.933", "references": [{"url": "https://support.1password.com/kb/202204/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-312"}]}], "descriptions": [{"lang": "en", "value": "1Password for Mac 7.2.4 through 7.9.x before 7.9.3 is vulnerable to a process validation bypass. Malicious software running on the same computer can exfiltrate secrets from 1Password provided that 1Password is running and is unlocked. Affected secrets include vault items and derived values used for signing in to 1Password."}, {"lang": "es", "value": "1Password para Mac versiones 7.2.4 hasta 7.9.x anteriores a 7.9.3, es vulnerable a una omisi\u00f3n de comprobaci\u00f3n de procesos. El software malicioso que es ejecutado en el mismo equipo puede exfiltrar secretos de 1Password siempre que \u00e9ste est\u00e9 ejecut\u00e1ndose y est\u00e9 desbloqueado. Los secretos afectados incluyen elementos de la b\u00f3veda y valores derivados usados para iniciar sesi\u00f3n en 1Password"}], "lastModified": "2022-05-18T16:45:36.750", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:1password:1password:*:*:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "FB837E4A-9B42-4C96-A4BF-5E91F8DF6975", "versionEndExcluding": "7.9.3", "versionStartIncluding": "7.2.4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}