Vulnerability Description
Slack-Chat through 1.5.5 leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.).
CVSS Score
7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Slack-Chat Project | Slack-Chat | <= 1.5.5 |
Related Weaknesses (CWE)
References
- https://gist.github.com/fs0c131y/e47035f0493a2f558fccc172ada715efThird Party Advisory
- https://github.com/arjunmat/slack-chat/commits/masterPatchThird Party Advisory
- https://gist.github.com/fs0c131y/e47035f0493a2f558fccc172ada715efThird Party Advisory
- https://github.com/arjunmat/slack-chat/commits/masterPatchThird Party Advisory
FAQ
What is CVE-2019-14367?
CVE-2019-14367 is a vulnerability with a CVSS score of 7.5 (HIGH). Slack-Chat through 1.5.5 leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack (channels, members, etc.).
How severe is CVE-2019-14367?
CVE-2019-14367 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-14367?
Check the references section above for vendor advisories and patch information. Affected products include: Slack-Chat Project Slack-Chat.