Search criteria
3 vulnerabilities found for starbucks by starbucks
VAR-201401-0352
Vulnerability from variot - Updated: 2025-04-11 23:18The Starbucks 2.6.1 application for iOS stores sensitive information in plaintext in the Crashlytics log file (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog), which allows attackers to discover usernames, passwords, and e-mail addresses via an application that reads session.clslog. Starbucks is prone to an information-disclosure vulnerability. Successfully exploiting this issue may allow attackers to obtain sensitive information from the application, that may aid in further attacks. Starbucks 2.6.1 is vulnerable; other versions may also be affected. Starbucks is a set of mobile applications for the IOS platform of Starbucks in the United States. The application supports GPS automatic positioning, querying product introductions, understanding event information, etc
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201401-0352",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "starbucks",
"scope": "eq",
"trust": 1.6,
"vendor": "starbucks",
"version": "2.6.1"
},
{
"model": "starbucks",
"scope": "eq",
"trust": 0.8,
"vendor": "starbucks coffee",
"version": "2.6.1"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-001269"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-560"
},
{
"db": "NVD",
"id": "CVE-2014-0647"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:starbucks:starbucks",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-001269"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Daniel E. Wood",
"sources": [
{
"db": "BID",
"id": "64942"
}
],
"trust": 0.3
},
"cve": "CVE-2014-0647",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "CVE-2014-0647",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 1.8,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "VHN-68140",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-0647",
"trust": 1.0,
"value": "LOW"
},
{
"author": "NVD",
"id": "CVE-2014-0647",
"trust": 0.8,
"value": "Low"
},
{
"author": "CNNVD",
"id": "CNNVD-201401-560",
"trust": 0.6,
"value": "LOW"
},
{
"author": "VULHUB",
"id": "VHN-68140",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-68140"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001269"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-560"
},
{
"db": "NVD",
"id": "CVE-2014-0647"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Starbucks 2.6.1 application for iOS stores sensitive information in plaintext in the Crashlytics log file (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog), which allows attackers to discover usernames, passwords, and e-mail addresses via an application that reads session.clslog. Starbucks is prone to an information-disclosure vulnerability. \nSuccessfully exploiting this issue may allow attackers to obtain sensitive information from the application, that may aid in further attacks. \nStarbucks 2.6.1 is vulnerable; other versions may also be affected. Starbucks is a set of mobile applications for the IOS platform of Starbucks in the United States. The application supports GPS automatic positioning, querying product introductions, understanding event information, etc",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-0647"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001269"
},
{
"db": "BID",
"id": "64942"
},
{
"db": "VULHUB",
"id": "VHN-68140"
}
],
"trust": 1.98
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-68140",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-68140"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-0647",
"trust": 2.8
},
{
"db": "BID",
"id": "64942",
"trust": 2.0
},
{
"db": "OSVDB",
"id": "102514",
"trust": 1.7
},
{
"db": "XF",
"id": "90412",
"trust": 1.4
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001269",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201401-560",
"trust": 0.7
},
{
"db": "BUGTRAQ",
"id": "20140114 [CVE-2014-0647] INSECURE DATA STORAGE OF USER DATA ELEMENTS IN STARBUCKS V2.6.1 IOS MOBILE APPLICATION",
"trust": 0.6
},
{
"db": "XF",
"id": "20140647",
"trust": 0.6
},
{
"db": "FULLDISC",
"id": "20140113 [CVE-2014-0647] INSECURE DATA STORAGE OF USER DATA ELEMENTS IN STARBUCKS V2.6.1 IOS MOBILE APPLICATION",
"trust": 0.6
},
{
"db": "FULLDISC",
"id": "20140117 RE: [CVE-2014-0647] INSECURE DATA STORAGE OF USER DATA ELEMENTS IN STARBUCKS V2.6.1 IOS MOBILE APPLICATION",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "124768",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-68140",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-68140"
},
{
"db": "BID",
"id": "64942"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001269"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-560"
},
{
"db": "NVD",
"id": "CVE-2014-0647"
}
]
},
"id": "VAR-201401-0352",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-68140"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-11T23:18:48.869000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Starbucks",
"trust": 0.8,
"url": "https://itunes.apple.com/us/app/starbucks/id331177714?mt=8"
},
{
"title": "Mobile Apps",
"trust": 0.8,
"url": "http://www.starbucks.com/coffeehouse/mobile-apps"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-001269"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-68140"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001269"
},
{
"db": "NVD",
"id": "CVE-2014-0647"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://seclists.org/fulldisclosure/2014/jan/123"
},
{
"trust": 2.5,
"url": "http://www.zdnet.com/starbucks-fixes-ios-app-bugs-7000025323/"
},
{
"trust": 2.5,
"url": "http://www.zdnet.com/the-starbucks-bug-not-as-awful-as-reported-7000025269/"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/64942"
},
{
"trust": 1.7,
"url": "http://seclists.org/fulldisclosure/2014/jan/64"
},
{
"trust": 1.7,
"url": "https://itunes.apple.com/us/app/starbucks/id331177714?mt=8"
},
{
"trust": 1.7,
"url": "http://www.osvdb.org/102514"
},
{
"trust": 1.4,
"url": "http://xforce.iss.net/xforce/xfdb/90412"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/530756/100/0/threaded"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90412"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0647"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0647"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/530756/100/0/threaded"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-68140"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001269"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-560"
},
{
"db": "NVD",
"id": "CVE-2014-0647"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-68140"
},
{
"db": "BID",
"id": "64942"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001269"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-560"
},
{
"db": "NVD",
"id": "CVE-2014-0647"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-01-28T00:00:00",
"db": "VULHUB",
"id": "VHN-68140"
},
{
"date": "2014-01-13T00:00:00",
"db": "BID",
"id": "64942"
},
{
"date": "2014-01-29T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-001269"
},
{
"date": "2014-01-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201401-560"
},
{
"date": "2014-01-28T00:55:03.957000",
"db": "NVD",
"id": "CVE-2014-0647"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-68140"
},
{
"date": "2014-01-22T01:02:00",
"db": "BID",
"id": "64942"
},
{
"date": "2014-01-29T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-001269"
},
{
"date": "2014-01-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201401-560"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2014-0647"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201401-560"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "iOS for Starbucks Vulnerability that information such as user name is acquired in the application",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-001269"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201401-560"
}
],
"trust": 0.6
}
}
CVE-2014-0647 (GCVE-0-2014-0647)
Vulnerability from nvd – Published: 2014-01-28 00:00 – Updated: 2024-08-06 09:20
VLAI?
Summary
The Starbucks 2.6.1 application for iOS stores sensitive information in plaintext in the Crashlytics log file (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog), which allows attackers to discover usernames, passwords, and e-mail addresses via an application that reads session.clslog.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T09:20:19.937Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.zdnet.com/the-starbucks-bug-not-as-awful-as-reported-7000025269/"
},
{
"name": "20140113 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2014/Jan/64"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://itunes.apple.com/us/app/starbucks/id331177714?mt=8"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.zdnet.com/starbucks-fixes-ios-app-bugs-7000025323/"
},
{
"name": "20140114 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/530756/100/0/threaded"
},
{
"name": "20140117 Re: [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2014/Jan/123"
},
{
"name": "64942",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/64942"
},
{
"name": "102514",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/102514"
},
{
"name": "starbucks-cve20140647-info-disclosure(90412)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90412"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-01-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Starbucks 2.6.1 application for iOS stores sensitive information in plaintext in the Crashlytics log file (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog), which allows attackers to discover usernames, passwords, and e-mail addresses via an application that reads session.clslog."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.zdnet.com/the-starbucks-bug-not-as-awful-as-reported-7000025269/"
},
{
"name": "20140113 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2014/Jan/64"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://itunes.apple.com/us/app/starbucks/id331177714?mt=8"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.zdnet.com/starbucks-fixes-ios-app-bugs-7000025323/"
},
{
"name": "20140114 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/530756/100/0/threaded"
},
{
"name": "20140117 Re: [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2014/Jan/123"
},
{
"name": "64942",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/64942"
},
{
"name": "102514",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/102514"
},
{
"name": "starbucks-cve20140647-info-disclosure(90412)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90412"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-0647",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Starbucks 2.6.1 application for iOS stores sensitive information in plaintext in the Crashlytics log file (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog), which allows attackers to discover usernames, passwords, and e-mail addresses via an application that reads session.clslog."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.zdnet.com/the-starbucks-bug-not-as-awful-as-reported-7000025269/",
"refsource": "MISC",
"url": "http://www.zdnet.com/the-starbucks-bug-not-as-awful-as-reported-7000025269/"
},
{
"name": "20140113 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2014/Jan/64"
},
{
"name": "https://itunes.apple.com/us/app/starbucks/id331177714?mt=8",
"refsource": "MISC",
"url": "https://itunes.apple.com/us/app/starbucks/id331177714?mt=8"
},
{
"name": "http://www.zdnet.com/starbucks-fixes-ios-app-bugs-7000025323/",
"refsource": "MISC",
"url": "http://www.zdnet.com/starbucks-fixes-ios-app-bugs-7000025323/"
},
{
"name": "20140114 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/530756/100/0/threaded"
},
{
"name": "20140117 Re: [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2014/Jan/123"
},
{
"name": "64942",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/64942"
},
{
"name": "102514",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/102514"
},
{
"name": "starbucks-cve20140647-info-disclosure(90412)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90412"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-0647",
"datePublished": "2014-01-28T00:00:00.000Z",
"dateReserved": "2014-01-02T00:00:00.000Z",
"dateUpdated": "2024-08-06T09:20:19.937Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-0647 (GCVE-0-2014-0647)
Vulnerability from cvelistv5 – Published: 2014-01-28 00:00 – Updated: 2024-08-06 09:20
VLAI?
Summary
The Starbucks 2.6.1 application for iOS stores sensitive information in plaintext in the Crashlytics log file (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog), which allows attackers to discover usernames, passwords, and e-mail addresses via an application that reads session.clslog.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T09:20:19.937Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.zdnet.com/the-starbucks-bug-not-as-awful-as-reported-7000025269/"
},
{
"name": "20140113 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2014/Jan/64"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://itunes.apple.com/us/app/starbucks/id331177714?mt=8"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.zdnet.com/starbucks-fixes-ios-app-bugs-7000025323/"
},
{
"name": "20140114 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/530756/100/0/threaded"
},
{
"name": "20140117 Re: [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2014/Jan/123"
},
{
"name": "64942",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/64942"
},
{
"name": "102514",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/102514"
},
{
"name": "starbucks-cve20140647-info-disclosure(90412)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90412"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-01-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Starbucks 2.6.1 application for iOS stores sensitive information in plaintext in the Crashlytics log file (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog), which allows attackers to discover usernames, passwords, and e-mail addresses via an application that reads session.clslog."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.zdnet.com/the-starbucks-bug-not-as-awful-as-reported-7000025269/"
},
{
"name": "20140113 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2014/Jan/64"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://itunes.apple.com/us/app/starbucks/id331177714?mt=8"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.zdnet.com/starbucks-fixes-ios-app-bugs-7000025323/"
},
{
"name": "20140114 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/530756/100/0/threaded"
},
{
"name": "20140117 Re: [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2014/Jan/123"
},
{
"name": "64942",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/64942"
},
{
"name": "102514",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/102514"
},
{
"name": "starbucks-cve20140647-info-disclosure(90412)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90412"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-0647",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Starbucks 2.6.1 application for iOS stores sensitive information in plaintext in the Crashlytics log file (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog), which allows attackers to discover usernames, passwords, and e-mail addresses via an application that reads session.clslog."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.zdnet.com/the-starbucks-bug-not-as-awful-as-reported-7000025269/",
"refsource": "MISC",
"url": "http://www.zdnet.com/the-starbucks-bug-not-as-awful-as-reported-7000025269/"
},
{
"name": "20140113 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2014/Jan/64"
},
{
"name": "https://itunes.apple.com/us/app/starbucks/id331177714?mt=8",
"refsource": "MISC",
"url": "https://itunes.apple.com/us/app/starbucks/id331177714?mt=8"
},
{
"name": "http://www.zdnet.com/starbucks-fixes-ios-app-bugs-7000025323/",
"refsource": "MISC",
"url": "http://www.zdnet.com/starbucks-fixes-ios-app-bugs-7000025323/"
},
{
"name": "20140114 [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/530756/100/0/threaded"
},
{
"name": "20140117 Re: [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2014/Jan/123"
},
{
"name": "64942",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/64942"
},
{
"name": "102514",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/102514"
},
{
"name": "starbucks-cve20140647-info-disclosure(90412)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90412"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-0647",
"datePublished": "2014-01-28T00:00:00.000Z",
"dateReserved": "2014-01-02T00:00:00.000Z",
"dateUpdated": "2024-08-06T09:20:19.937Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}