Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2020-13637 Details

Description

An issue was discovered in the stashcat app through 3.9.2 for macOS, Windows, Android, iOS, and possibly other platforms. It stores the client_key, the device_id, and the public key for end-to-end encryption in cleartext, enabling an attacker (by copying or having access to the local storage database file) to login to the system from any other computer, and get unlimited access to all data in the users's context.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
http://www.jvanlaak.de/stashcat_CWE_312_200527.pdf CVEThird Party Advisory
http://www.jvanlaak.de/stashcat.html CVEThird Party Advisory
http://www.jvanlaak.de/stashcat_CWE_312_200527.pdf [email protected]Third Party Advisory
http://www.jvanlaak.de/stashcat.html [email protected]Third Party Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-312Cleartext Storage of Sensitive Information[email protected]

Affected Products

ProductVersions
heinekingmedia stashcat
<= 3.9.2

CPE

  • cpe:2.3:a:heinekingmedia:stashcat:*:*:*:*:*:android:*:*
  • cpe:2.3:a:heinekingmedia:stashcat:*:*:*:*:*:iphone_os:*:*
  • cpe:2.3:a:heinekingmedia:stashcat:*:*:*:*:*:macos:*:*
  • cpe:2.3:a:heinekingmedia:stashcat:*:*:*:*:*:windows:*:*

Remediation

  • No remediation found in references.

Change History

5 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2020-13637
NVD Published Date:
Jun 17, 2020
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2020-13637 Details - Not Deferred