CVE-2024-45833CWE-693

Mobile password gets saved in dictionary under conditions

Medium · published September 16, 2024

CVSS v3.1
4.5
EPSS
0%
Percentile
26.9
In the wild
Unconfirmed
What it is

Mattermost Mobile Apps versions <=2.18.0 fail to disable autocomplete during login while typing the password and visible password is selected, which allows the password to get saved in the dictionary when the user has Swiftkey as the default keyboard, the masking is off and the password contains a special character..

The record
Technical detail
CVSS v3.1
4.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00346 · 26.9th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2024-09-16T06:41Z
EPSS history
Timeline
  • 16 SEP 06:41Z
    Mobile password gets saved in dictionary under conditions
    cvelistv5