CVE-2023-33187
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Highlight is an open-source monitoring platform that may record passwords when an HTML password input is switched to `type="text"` via a JavaScript 'Show Password' button. This behavior differs from the expected one that always obfuscates `password` type inputs.
Risk Assessment
The organization may unintentionally record user passwords, leading to serious security breaches and loss of data confidentiality. Users may assume their passwords are not being recorded, increasing the risk of information leakage.
Recommendation
It is recommended to update to version 6.0.0 or later to ensure that changes to the `type` attribute are properly tracked and passwords are always obfuscated. Additionally, implementing extra security measures such as CSS masking classes is advisable.
Original NVD description (English source)
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `type="password"` inputs. A customer may assume that switching to `type="text"` would also not record this input; hence, they would not add additional `highlight-mask` css-class obfuscation to this part of the DOM, resulting in unintentional recording of a password value when a `Show Password` button is used. This issue was patched in version 6.0.0. This patch tracks changes to the `type` attribute of an input to ensure an input that used to be a `type="password"` continues to be obfuscated.