CVE-2018-25081 - Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element

Back Back to CVE browser

HIGH

Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element

Published Mar 8, 2023

7.5

HIGH

CVSS 3.1

EPSS 1.03%

Description

Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element. NOTE: the vendor's position is that there have been important legitimate cross-domain configurations (e.g., an apple.com IFRAME element on the icloud.com website) and that "Auto-fill on page load" is not enabled by default.

Affected products

Vendor Bitwarden Product Bitwarden Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=2023.2.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Bitwarden

n/a

Version	Status	Constraints
0	affected	<=2023.2.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (4)

https://cdn.bitwarden.net/misc/Bitwarden%20Security%20Assessment%20Report.pdf
Technical DescriptionVendor Advisory
https://flashpoint.io/blog/bitwarden-password-pilfering/
ExploitThird Party Advisory
https://github.com/bitwarden/clients/releases
Release Notes
https://news.ycombinator.com/item?id=35075861
Third Party Advisory

Link	Providers	Tags
https://cdn.bitwarden.net/misc/Bitwarden%20Security%20Assessment%20Report.pdf		Technical DescriptionVendor Advisory
https://flashpoint.io/blog/bitwarden-password-pilfering/		ExploitThird Party Advisory
https://github.com/bitwarden/clients/releases		Release Notes
https://news.ycombinator.com/item?id=35075861		Third Party Advisory