CVE-2017-1000024

Published: Jul 17, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token plaintext transmission

Affected (2)

Products: Gnome: Shotwell

Gnome

1 product

Shotwell

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Gnome Shotwell	From 0.24.0 to 0.24.4
Gnome Shotwell	From 0.25.0 to 0.25.3

Related CWEs

CWE-319

Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

References (2)

https://mail.gnome.org/archives/shotwell-list/2017-January/msg00048.html

Source: cve@mitre.org

Mailing ListVendor Advisory

https://mail.gnome.org/archives/shotwell-list/2017-January/msg00048.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

Timeline

No history available yet.