CVE-2023-40580CWE-200

Freighter mnemonic phrase may be accessed by Javascript through a private API

High · published August 25, 2023

CVSS v3.1
8.1
EPSS
1%
Percentile
51.7
In the wild
Unconfirmed
What it is

Freighter is a Stellar chrome extension. It may be possible for a malicious website to access the recovery mnemonic phrase when the Freighter wallet is unlocked. This vulnerability impacts access control to the mnemonic recovery phrase. This issue was patched in version 5.3.1.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00676 · 51.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2023-08-25T19:51Z
EPSS history
Timeline
  • 25 AUG 19:51Z
    Freighter mnemonic phrase may be accessed by Javascript through a private API
    cvelistv5