CVE-2024-39846

—

CVSS 3.1

3.5 low

EPSS

<1%p9

Published

Jun 29, 2024 (Jun 29, 2024)

Modified

Jun 17, 2026

Description

NewPass before 1.2.0 stores passwords (rather than password hashes) directly, which makes it easier to obtain unauthorized access to sensitive information. NOTE: in each case, data at rest is encrypted, but is decrypted within process memory during use.

Weakness: CWE-312
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.