High severity · published Jul 8, 2019
CVE-2019-12171
Dropbox.exe (and QtWebEngineProcess.exe in the Web Helper) in the Dropbox desktop application 71.4.108.0 store cleartext credentials in memory upon successful login or new account…
7.8
CVSS
0.9%
EPSS
No
On KEV
Description
Dropbox.exe (and QtWebEngineProcess.exe in the Web Helper) in the Dropbox desktop application 71.4.108.0 store cleartext credentials in memory upon successful login or new account creation. These are not securely freed in the running process.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DR
Dropbox · Dropbox
71.4.108.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-12171
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-12171
Exploit
https://drive.google.com/open?id=1DCGurwRTu0HsUpTglVR0jgItZNqqDm_5
Exploit
https://drive.google.com/open?id=1msz6pb08crPC0VT7s_Z_KTsKm9CbLJEXNsmRwzoNLy8
More from Dropbox
8.8
CVE-2024-5924
Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability
6.4
CVE-2018-12271
An issue was discovered in the com.getdropbox.Dropbox app 100.2 for iOS
3.6
CVE-2018-12446
An issue was discovered in the com.dropbox.android application 98.2.2 for Android
3.1
CVE-2018-12445
An issue was discovered in the com.dropbox.android application 98.2.2 for Android
–
CVE-2010-3354
dropboxd in Dropbox 0.7.110 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the…