GCVE - cpe:2.3:a:passbolt:passbolt_api:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:passbolt:passbolt_api:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Passbolt (`932a0ec1-567c-568c-a7bd-9ce083e0a30a`)
Product	Passbolt Api (`3850a306-fe48-597e-917d-9b92cda9e46e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:bitbucket/passbolt_pro/passbolt_pro_api`	purl2cpe	2026-06-01 10:11:09.418864
`pkg:github/passbolt/passbolt_api`	purl2cpe	2026-06-01 10:11:09.418868
`pkg:npm/passbolt-appjs`	purl2cpe	2026-06-01 10:11:09.418870
`pkg:pypi/passbolt-api`	purl2cpe	2026-06-01 10:11:09.418873

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-27913`	vulnerable	2026-06-08 07:14:55.831494	Details available Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP Host header. Published: 2025-03-10T00:00:00.000Z Updated: 2025-03-11T02:52:25.597Z Open on db.gcve.eu Reference links https://www.passbolt.com/incidents/host-header-injection	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-33670`	vulnerable	2026-06-08 06:37:31.947428	Details available MEDIUM (4.3) Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy (CSP) restrictions, it may still impact the appearance and user interaction of the page. Published: 2024-04-26T00:00:00.000Z Updated: 2024-08-02T02:36:04.533Z Open on db.gcve.eu Reference links https://www.passbolt.com/security/more https://www.passbolt.com/incidents https://help.passbolt.com/incidents/reflective-html-injection-vulnerability	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-33669`	vulnerable	2026-06-08 06:37:31.945529	Details available MEDIUM (6.1) An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned while a password is being typed, which results in an information leak. This allows an attacker capable of observing Passbolt's HTTPS queries to the Pwned Password API to more easily brute force passwords that are manually typed by the user. Published: 2024-04-26T00:00:00.000Z Updated: 2024-08-02T02:36:04.567Z Open on db.gcve.eu Reference links https://www.passbolt.com https://haveibeenpwned.com https://blog.quarkslab.com/passbolt-a-bold-use-of-haveibeenpwned.html https://www.passbolt.com/security/more https://help.passbolt.com/incidents/pwned-password-service-information-leak	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-1000442`	vulnerable	2026-06-08 05:08:34.553513	Details available Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace Published: 2018-01-02T14:00:00.000Z Updated: 2024-09-17T01:40:41.577Z Open on db.gcve.eu Reference links https://www.passbolt.com/incidents/20170914_xss_on_resource_urls https://www.passbolt.com/release/notes#September	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.