{"id":"CVE-2017-1000024","aliases":["DEBIAN-CVE-2017-1000024","EUVD-2017-1353","GHSA-w69f-r5ch-7w68","MGASA-2017-0480","SUSE-SU-2018:0637-1","UBUNTU-CVE-2017-1000024","USN-3379-1"],"status":"published","title":"Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information...","description":"Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token plaintext transmission","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-13","score":0.01209,"percentile":0.68867,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-319"],"published":"2017-07-13T20:00:00Z","modified":"2026-10-24T10:31:00Z","fixes":[{"ecosystem":"Debian:12","package":"shotwell","fixed_in":["0.25.4+really0.24.5-0.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"shotwell","fixed_in":["0.25.4+really0.24.5-0.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"shotwell","fixed_in":["0.25.4+really0.24.5-0.1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"shotwell","fixed_in":["0.22.1-0.20160310.1.1.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"shotwell","fixed_in":["0.22.0+git.20160103-15.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"shotwell","fixed_in":["0.22.0+git.20160103-15.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP2","package":"shotwell","fixed_in":["0.22.0+git.20160103-15.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"shotwell","fixed_in":["0.22.0+git.20160103-15.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"shotwell","fixed_in":["0.18.0-0ubuntu4.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"shotwell","fixed_in":["0.22.0+git20160108.r1.f2fb1f7-0ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"shotwell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.4+really0.24.5-0.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"shotwell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.4+really0.24.5-0.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"shotwell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.4+really0.24.5-0.1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"shotwell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-0.20160310.1.1.mga5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"shotwell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0+git.20160103-15.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"shotwell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0+git.20160103-15.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP2","package":"shotwell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0+git.20160103-15.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"shotwell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0+git.20160103-15.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"shotwell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-0ubuntu4.5"}]}],"versions":["0.15.0-0ubuntu1","0.15.0-0ubuntu2","0.15.1-0ubuntu1","0.15.1-0ubuntu2","0.15.1-0ubuntu3","0.17.0-0ubuntu1","0.17.1-0ubuntu2","0.17.2-0ubuntu1","0.18.0-0ubuntu2","0.18.0-0ubuntu3","0.18.0-0ubuntu4","0.18.0-0ubuntu4.1","0.18.0-0ubuntu4.2","0.18.0-0ubuntu4.3","0.18.0-0ubuntu4.4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"shotwell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0+git20160108.r1.f2fb1f7-0ubuntu1.1"}]}],"versions":["0.22.0-0ubuntu5","0.22.0-2ubuntu1","0.22.0+git20160108.r1.f2fb1f7-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"shotwell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-0ubuntu4.5"}]}],"versions":["0.15.0-0ubuntu1","0.15.0-0ubuntu2","0.15.1-0ubuntu1","0.15.1-0ubuntu2","0.15.1-0ubuntu3","0.17.0-0ubuntu1","0.17.1-0ubuntu2","0.17.2-0ubuntu1","0.18.0-0ubuntu2","0.18.0-0ubuntu3","0.18.0-0ubuntu4","0.18.0-0ubuntu4.1","0.18.0-0ubuntu4.2","0.18.0-0ubuntu4.3","0.18.0-0ubuntu4.4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"shotwell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0+git20160108.r1.f2fb1f7-0ubuntu1.1"}]}],"versions":["0.22.0-0ubuntu5","0.22.0-2ubuntu1","0.22.0+git20160108.r1.f2fb1f7-0ubuntu1"]}],"products":[{"vendor":"gnome","product":"shotwell"}],"references":[{"url":"https://mail.gnome.org/archives/shotwell-list/2017-January/msg00048.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Vendor Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000024"},{"url":"https://github.com/advisories/GHSA-w69f-r5ch-7w68"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-1000024","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0480.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21478","tags":["report"]},{"url":"https://usn.ubuntu.com/usn/usn-3379-1/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180637-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1054311","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000024","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-1000024","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3379-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1000024","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-1000024","description":"Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token plaintext transmission","status":"published","published":"2017-07-13T20:00:00Z","modified":"2024-08-05T21:53:06.296Z","updated_at":"2026-11-02T14:33:21.142987Z"}],"euvd":[{"id":"EUVD-2017-1353","description":"Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token plaintext transmission","status":"published","published":"2017-07-13T20:00:00Z","modified":"2024-08-05T21:53:06Z","updated_at":"2026-11-03T02:23:04.143753Z"}],"ghsa":[{"id":"GHSA-w69f-r5ch-7w68","title":"Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information...","description":"Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token plaintext transmission","status":"published","published":"2022-05-13T01:40:53Z","modified":"2023-02-02T05:00:39Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T14:51:00.787712Z"}],"nvd":[{"id":"CVE-2017-1000024","description":"Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token plaintext transmission","status":"published","published":"2017-07-17T13:18:16.673Z","modified":"2026-06-17T00:58:36.377Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T14:03:54.012105Z"}],"osv":[{"id":"CVE-2017-1000024","description":"Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token plaintext transmission","status":"published","published":"2017-07-17T13:18:16.673Z","modified":"2026-10-24T10:31:00.244343168Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:03.472693Z"},{"id":"DEBIAN-CVE-2017-1000024","description":"Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token plaintext transmission","status":"published","published":"2017-07-17T13:18:16.673Z","modified":"2026-09-01T20:03:40.382721377Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"UBUNTU-CVE-2017-1000024","description":"Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token plaintext transmission","status":"published","published":"2017-07-17T00:00:00Z","modified":"2026-02-04T03:42:16.305615Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"MGASA-2017-0480","title":"Updated shotwell packages fix security vulnerability","description":"It was discovered that Shotwell is vulnerable to an information\ndisclosure in the web publishing plugins resulting in potential\npassword and oauth token plaintext transmission (CVE-2017-1000024).\n","status":"published","published":"2017-12-31T15:14:43Z","modified":"2026-04-16T06:25:48.030166035Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"SUSE-SU-2018:0637-1","title":"Security update for shotwell","description":"This update for shotwell fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2017-1000024: Use HTTPS encryption all over the publishing plugins (bsc#1054311).\n","status":"published","published":"2018-03-08T17:07:10Z","modified":"2026-02-04T03:19:34.232115Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"USN-3379-1","title":"shotwell vulnerability","description":"It was discovered that Shotwell is vulnerable to an information disclosure\nin the web publishing plugins resulting in potential password and oauth token\nplaintext transmission.\n","status":"published","published":"2017-08-07T15:01:54Z","modified":"2026-02-10T04:41:11Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}