CVE-2023-27974

Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain matches, e.g., a password stored for an example.com hosting provider when customer-website.example.com is visited. NOTE: the vendor's position is that "Auto-fill on page load" is not enabled by default.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

1.00% chance of exploitation in the next 30 days, 60th percentile

Published

2023-03-08

Updated

2024-08-02

Proof-of-concept exploits (1)

• https://flashpoint.io/blog/bitwarden-password-pilfering/

References

• CVE Record
• NVD entry

Related

• CVE-2023-2796
• CVE-2023-2799
• CVE-2023-2795
• CVE-2023-27997
• CVE-2023-27922
• CVE-2023-2802