CVE-2019-19022

Published: Nov 17, 2019Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote attackers to obtain sensitive information, as demonstrated by searching for the NoSyncSearchHistory string in .plist files within public Git repositories.

Affected (1)

Products: Iterm2: Iterm2

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Iterm2 Iterm2	Up to 3.3.6

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://gitlab.com/gnachman/iterm2/issues/8491

Source: cve@mitre.org

ExploitThird Party Advisory

https://gitlab.com/gnachman/iterm2/issues/8491

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.