Skip to content
OpenAdvisories
Medium WID-SEC-2025-0042 3 CVEs

Vaultwarden: Mehrere Schwachstellen

Published Jan 9, 2025 · Updated Jan 21, 2025 · Revision 3 · de-DE

Vendor: Fedora Product: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Vaultwarden ausnutzen, um Sicherheitsvorkehrungen zu umgehen, oder einen Cross Site Scripting Angriff auszuführen.

Product

Vaultwarden ist eine alternative Implementierung der Server API des Bitwarden Passwort-Managers.

Vulnerabilities 3

  • Critical 9.8
    CVE-2024-55225

    Vaultwarden vulnerable to user impersonation

    An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request.

    vaultwarden crates.io
  • Critical 9.6
    CVE-2024-55224

    Vaultwarden HTML injection vulnerability

    An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail message.

    vaultwarden crates.io
  • Medium 5.4
    CVE-2024-55226

    Vaultwarden authenticated reflected cross-site scripting (XSS) vulnerability

    Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/core/mod.rs.

    vaultwarden crates.io

Revision history

  1. #3

    Neue Updates von Fedora aufgenommen

  2. #2

    Neue Updates von Fedora aufgenommen

  3. #1

    Initiale Fassung

References