vulnwire
4.3med

CVE-2017-16560

SanDisk Secure Access 3.01 vault decrypts and copies encrypted files to a temporary folder, where they can remain indefinitely in certain s…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
4.3
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 36%
Public exploits
0
none known

SanDisk Secure Access 3.01 vault decrypts and copies encrypted files to a temporary folder, where they can remain indefinitely in certain situations, such as if the file is being edited when the user exits the application or if the application crashes.

Exploit prediction (EPSS)

0.42% probability of exploitation in the next 30 days, higher than 36% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.04.3CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD2.02.1AV:L/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-922 Insecure Storage of Sensitive Information

References

  • medium.com /%40esterling_/cve-2017-16560-sandisk-secure-access-leaves-plain-text-copies-of-files-on-d · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.