Unrated severityNVD Advisory· Published Mar 8, 2023· Updated Aug 19, 2024

CVE-2018-25081

Description

Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element. NOTE: the vendor's position is that there have been important legitimate cross-domain configurations (e.g., an apple.com IFRAME element on the icloud.com website) and that "Auto-fill on page load" is not enabled by default.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Bitwarden/Bitwardencpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=2023.2.1

Patches

Vulnerability mechanics

References

cdn.bitwarden.net/misc/Bitwarden%20Security%20Assessment%20Report.pdfmitre
flashpoint.io/blog/bitwarden-password-pilfering/mitre
github.com/bitwarden/clients/releasesmitre
news.ycombinator.com/itemmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000