CVE-2023-5718CWE-200

The Vue.js Devtools extension was found to leak screenshot data back to a malicious web page via the standard `postMessage()` API

Medium · published October 23, 2023

CVSS v3.1
4.3
EPSS
0%
Percentile
15.2
In the wild
Unconfirmed
What it is

The Vue.js Devtools extension was found to leak screenshot data back to a malicious web page via the standard `postMessage()` API. By creating a malicious web page with an iFrame targeting a sensitive resource (i.e. a locally accessible file or sensitive website), and registering a listener on the web page, the extension sent messages back to the listener, containing the base64 encoded screenshot data of the sensitive resource.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00248 · 15.2th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2023-10-23T14:02Z
EPSS history
Timeline
  • 23 OCT 14:02Z
    The Vue.js Devtools extension was found to leak screenshot data back to a malicious web page via the standard `postMessage()` API
    cvelistv5