CVE-2025-60794: Couchauth: güvenlik açığı

Açıklama (NVD)

Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. This creates a window of opportunity for sensitive data extraction through memory dumps, debugging tools, or other memory access techniques, potentially leading to session hijacking.

Özet bilgiler

Ürün

Perfood Couchauth

CVSS v3.1

6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

EPSS

%0,22 (yüzdelik 13)

CWE

CWE-316

Yama

Yok / bilinmiyor

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• github.com
• github.com
• www.npmjs.com
• CWE-316