CVE-2023-38840

Bitwarden Desktop 2023.7.0 and below allows an attacker with local access to obtain sensitive information via the Bitwarden.exe process.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 79%
VendorProductVersion
bitwardenbitwarden
𝑥
≤ 2023.7.0
𝑥
= Vulnerable software versions
References
https://github.com/bitwarden/clients/pull/5813
https://github.com/bitwarden/desktop/issues/476
https://github.com/markuta/bw-dump
https://redmaple.tech/blogs/2023/extract-bitwarden-vault-passwords/
https://github.com/bitwarden/clients/pull/5813
https://github.com/bitwarden/desktop/issues/476
https://github.com/markuta/bw-dump
https://redmaple.tech/blogs/2023/extract-bitwarden-vault-passwords/