CVE-2015-3454 TelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might allow remote attackers to obtain password hashes via a cross-site scripting attack.
HighCVSS 7.5
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
TelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might allow remote attackers to obtain password hashes via a cross-site scripting attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vulcanjs vulcan | <= 0.14.3 | No fix listed |
References
- [oss-security] 20150429 Re: CVE request - TelescopeJS Information Leakage: User BCrypt password hash post-authentication mailing-list
- 74331 third-party-advisory vdb-entry
- github.com patch third-party-advisory
- github.com issue-tracking third-party-advisory