CVE-2018-25081

Description

Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element. NOTE: the vendor's position is that there have been important legitimate cross-domain configurations (e.g., an apple.com IFRAME element on the icloud.com website) and that "Auto-fill on page load" is not enabled by default.

Weakness classification

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references

• cve@mitre.org — Technical Description, Vendor Advisory
• cve@mitre.org — Exploit, Third Party Advisory
• cve@mitre.org — Release Notes
• cve@mitre.org — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Technical Description, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory