VAR-201401-0352
Vulnerability from variot - Updated: 2025-04-11 23:18The Starbucks 2.6.1 application for iOS stores sensitive information in plaintext in the Crashlytics log file (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog), which allows attackers to discover usernames, passwords, and e-mail addresses via an application that reads session.clslog. Starbucks is prone to an information-disclosure vulnerability. Successfully exploiting this issue may allow attackers to obtain sensitive information from the application, that may aid in further attacks. Starbucks 2.6.1 is vulnerable; other versions may also be affected. Starbucks is a set of mobile applications for the IOS platform of Starbucks in the United States. The application supports GPS automatic positioning, querying product introductions, understanding event information, etc
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201401-0352",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "starbucks",
"scope": "eq",
"trust": 1.6,
"vendor": "starbucks",
"version": "2.6.1"
},
{
"model": "starbucks",
"scope": "eq",
"trust": 0.8,
"vendor": "starbucks coffee",
"version": "2.6.1"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-001269"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-560"
},
{
"db": "NVD",
"id": "CVE-2014-0647"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:starbucks:starbucks",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-001269"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Daniel E. Wood",
"sources": [
{
"db": "BID",
"id": "64942"
}
],
"trust": 0.3
},
"cve": "CVE-2014-0647",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "CVE-2014-0647",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 1.8,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "VHN-68140",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-0647",
"trust": 1.0,
"value": "LOW"
},
{
"author": "NVD",
"id": "CVE-2014-0647",
"trust": 0.8,
"value": "Low"
},
{
"author": "CNNVD",
"id": "CNNVD-201401-560",
"trust": 0.6,
"value": "LOW"
},
{
"author": "VULHUB",
"id": "VHN-68140",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-68140"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001269"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-560"
},
{
"db": "NVD",
"id": "CVE-2014-0647"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Starbucks 2.6.1 application for iOS stores sensitive information in plaintext in the Crashlytics log file (/Library/Caches/com.crashlytics.data/com.starbucks.mystarbucks/session.clslog), which allows attackers to discover usernames, passwords, and e-mail addresses via an application that reads session.clslog. Starbucks is prone to an information-disclosure vulnerability. \nSuccessfully exploiting this issue may allow attackers to obtain sensitive information from the application, that may aid in further attacks. \nStarbucks 2.6.1 is vulnerable; other versions may also be affected. Starbucks is a set of mobile applications for the IOS platform of Starbucks in the United States. The application supports GPS automatic positioning, querying product introductions, understanding event information, etc",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-0647"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001269"
},
{
"db": "BID",
"id": "64942"
},
{
"db": "VULHUB",
"id": "VHN-68140"
}
],
"trust": 1.98
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-68140",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-68140"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-0647",
"trust": 2.8
},
{
"db": "BID",
"id": "64942",
"trust": 2.0
},
{
"db": "OSVDB",
"id": "102514",
"trust": 1.7
},
{
"db": "XF",
"id": "90412",
"trust": 1.4
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001269",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201401-560",
"trust": 0.7
},
{
"db": "BUGTRAQ",
"id": "20140114 [CVE-2014-0647] INSECURE DATA STORAGE OF USER DATA ELEMENTS IN STARBUCKS V2.6.1 IOS MOBILE APPLICATION",
"trust": 0.6
},
{
"db": "XF",
"id": "20140647",
"trust": 0.6
},
{
"db": "FULLDISC",
"id": "20140113 [CVE-2014-0647] INSECURE DATA STORAGE OF USER DATA ELEMENTS IN STARBUCKS V2.6.1 IOS MOBILE APPLICATION",
"trust": 0.6
},
{
"db": "FULLDISC",
"id": "20140117 RE: [CVE-2014-0647] INSECURE DATA STORAGE OF USER DATA ELEMENTS IN STARBUCKS V2.6.1 IOS MOBILE APPLICATION",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "124768",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-68140",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-68140"
},
{
"db": "BID",
"id": "64942"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001269"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-560"
},
{
"db": "NVD",
"id": "CVE-2014-0647"
}
]
},
"id": "VAR-201401-0352",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-68140"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-11T23:18:48.869000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Starbucks",
"trust": 0.8,
"url": "https://itunes.apple.com/us/app/starbucks/id331177714?mt=8"
},
{
"title": "Mobile Apps",
"trust": 0.8,
"url": "http://www.starbucks.com/coffeehouse/mobile-apps"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-001269"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-68140"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001269"
},
{
"db": "NVD",
"id": "CVE-2014-0647"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://seclists.org/fulldisclosure/2014/jan/123"
},
{
"trust": 2.5,
"url": "http://www.zdnet.com/starbucks-fixes-ios-app-bugs-7000025323/"
},
{
"trust": 2.5,
"url": "http://www.zdnet.com/the-starbucks-bug-not-as-awful-as-reported-7000025269/"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/64942"
},
{
"trust": 1.7,
"url": "http://seclists.org/fulldisclosure/2014/jan/64"
},
{
"trust": 1.7,
"url": "https://itunes.apple.com/us/app/starbucks/id331177714?mt=8"
},
{
"trust": 1.7,
"url": "http://www.osvdb.org/102514"
},
{
"trust": 1.4,
"url": "http://xforce.iss.net/xforce/xfdb/90412"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/530756/100/0/threaded"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90412"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0647"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0647"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/530756/100/0/threaded"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-68140"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001269"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-560"
},
{
"db": "NVD",
"id": "CVE-2014-0647"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-68140"
},
{
"db": "BID",
"id": "64942"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001269"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-560"
},
{
"db": "NVD",
"id": "CVE-2014-0647"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-01-28T00:00:00",
"db": "VULHUB",
"id": "VHN-68140"
},
{
"date": "2014-01-13T00:00:00",
"db": "BID",
"id": "64942"
},
{
"date": "2014-01-29T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-001269"
},
{
"date": "2014-01-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201401-560"
},
{
"date": "2014-01-28T00:55:03.957000",
"db": "NVD",
"id": "CVE-2014-0647"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-68140"
},
{
"date": "2014-01-22T01:02:00",
"db": "BID",
"id": "64942"
},
{
"date": "2014-01-29T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-001269"
},
{
"date": "2014-01-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201401-560"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2014-0647"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201401-560"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "iOS for Starbucks Vulnerability that information such as user name is acquired in the application",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-001269"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201401-560"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…