In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaSc…
Medium CVSS 5.3
Summary
In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/Meesho/BharatMLStack
- https://github.com/wincr4ck/security-advisories/blob/main/bharatmlstack-cve-writeup.md
Timeline
- nvd_ingest NVD