CVE-2014-0647 The Starbucks 2.6.1 application for iOS stores sensitive information in plaintext in the Crashlytics log file (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog), which all...
LowCVSS 2.1
EPSS 0.38%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Starbucks 2.6.1 application for iOS stores sensitive information in plaintext in the Crashlytics log file (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog), which allows attackers to discover usernames, passwords, and e-mail addresses via an application that reads session.clslog.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| starbucks | = 2.6.1 | No fix listed |
References
- 20140117 Re: [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application mailing-list
- 20140113 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application mailing-list
- 102514 vdb-entry
- 20140114 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application mailing-list
- 64942 vdb-entry
- www.zdnet.com
- www.zdnet.com
- starbucks-cve20140647-info-disclosure(90412) vdb-entry
- itunes.apple.com