CVE-2008-7272 - FireGPG before 0.6 handle user’s passphrase and decrypted cleartext insecurely by writing pre-encryp

CVE-2008-7272

Summary

FireGPG before 0.6 handle user’s passphrase and decrypted cleartext insecurely by writing pre-encrypted cleartext and the user's passphrase to disk which may result in the compromise of secure communication or a users’s private key.

References

Vulnerable Configurations

cpe:2.3:a:getfiregpg:firegpg:-:*:*:*:*:firefox:*:*
cpe:2.3:a:getfiregpg:firegpg:-:*:*:*:*:firefox:*:*

CVSS

Base:	5.0 (as of 10-02-2020 - 21:16)
Impact:
Exploitability:

CWE

CWE-312

CAPEC

Retrieve Embedded Sensitive Data
An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	NONE	NONE

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:N/A:N

refmap via4

misc

Last major update

10-02-2020 - 21:16

Published

08-11-2019 - 00:15

Last modified

10-02-2020 - 21:16