What is CVE-2019-12171?

CVE-2019-12171 is a high-severity vulnerability in Dropbox, classified under Cleartext Storage of Sensitive Information. CVSS score: 7.8/10. Published 2019-07-08.

How severe is CVE-2019-12171?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Dropbox

CVE-2019-12171

Dropbox.exe (and QtWebEngineProcess.exe in the Web Helper) in the Dropbox desktop application 71.4.108.0 store cleartext credentials in memory upon successful login or new account creation. These are not securely freed in the running process.

EPSS: 0.009 (56.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Dropbox — versions 71.4.108.0
N/a — versions n/a

Weakness classification (CWE)

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2019-12171?: CVE-2019-12171 is a high-severity vulnerability in Dropbox, classified under Cleartext Storage of Sensitive Information. CVSS score: 7.8/10. Published 2019-07-08.
How severe is CVE-2019-12171?: High severity. CVSS v3 base score is 7.8 out of 10.