Vulnerabilities

TI-2023-20119 CVE-2023-38840 · GHSA-vc8h-v53f-wpq5

Bitwarden Desktop 2023.7.0 and below allows an attacker with local access to obtain…

LOW 25

Bitwarden Desktop 2023.7.0 and below allows an attacker with local access to obtain sensitive information via the Bitwarden.exe process.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00516 Published 2023-08-15 No fix listed

TI-2023-12369 CVE-2023-27706 · GHSA-fq2f-69mj-r56v

Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in…

HIGH 66

Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, accessible to other local unprivileged processes.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00585 Published 2023-06-09 No fix listed CWE-312

TI-2023-12564 CVE-2023-27974 · GHSA-76q7-gm7v-vj5q

Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain…

HIGH 66

Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain matches, e.g., a password stored for an example.com hosting provider when customer-website.example.com is visited.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00987 Published 2023-03-08 No fix listed

TI-2018-15308 CVE-2018-25081 · GHSA-9g2x-mr5w-6mrm

Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element.

MEDIUM 41

Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01029 Published 2023-03-08 No fix listed CWE-200

Vulnerabilities

Filters

Bitwarden Desktop 2023.7.0 and below allows an attacker with local access to obtain…

Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in…

Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain…

Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element.