High severity · published Jul 17, 2017
CVE-2017-1000024
Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token…
7.5
CVSS
1.2%
EPSS
No
On KEV
Description
Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token plaintext transmission
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SH
Shotwell · Gnome
0.24.0 through 0.24.4; 0.25.0 through 0.25.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-1000024
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-1000024
Mailing List
https://mail.gnome.org/archives/shotwell-list/2017-January/msg00048.html
More from Shotwell
3.7
CVE-2016-1000033
Shotwell version 0.22.0 (and possibly other versions) is vulnerable to a TLS/SSL certification validation flaw resulting in a potential for man in the middle attacks