« Volver al listado

CVE-2014-0647

Estado: ModificadaBaja (2.1)—

La aplicación Starbucks 2.6.1 para iOS almacena información sensible en texto plano en el archivo log de Crashlyrics (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog), lo que permite a atacantes descubrir nombres de usuario, contraseñas, y direcciones de e-mail a través de una aplicación que lea session.clslog.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Starbucks — Starbucks

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-0647",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.1,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-01-28T00:55:03.957",
  "references": [
    {
      "url": "http://seclists.org/fulldisclosure/2014/Jan/123",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2014/Jan/64",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/102514",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/530756/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/64942",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.zdnet.com/starbucks-fixes-ios-app-bugs-7000025323/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.zdnet.com/the-starbucks-bug-not-as-awful-as-reported-7000025269/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90412",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://itunes.apple.com/us/app/starbucks/id331177714?mt=8",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2014/Jan/123",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2014/Jan/64",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/102514",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/530756/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/64942",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.zdnet.com/starbucks-fixes-ios-app-bugs-7000025323/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.zdnet.com/the-starbucks-bug-not-as-awful-as-reported-7000025269/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90412",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://itunes.apple.com/us/app/starbucks/id331177714?mt=8",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-255"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Starbucks 2.6.1 application for iOS stores sensitive information in plaintext in the Crashlytics log file (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog), which allows attackers to discover usernames, passwords, and e-mail addresses via an application that reads session.clslog."
    },
    {
      "lang": "es",
      "value": "La aplicación Starbucks 2.6.1 para iOS almacena información sensible en texto plano en el archivo log de Crashlyrics (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog), lo que permite a atacantes descubrir nombres de usuario, contraseñas, y direcciones de e-mail a través de una aplicación que lea session.clslog."
    }
  ],
  "lastModified": "2026-06-17T00:03:25.657",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:starbucks:starbucks:2.6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F970B50-FBA6-4885-9D5A-E8D78B16BFD2"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "340C4071-1447-477F-942A-8E09EA29F917"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}