CVE-2019-19022

HIGH

iTerm2 < 3.3.6 - Sensitive Information Exposure via Search History in Plist File

Title source: llm

Description

iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote attackers to obtain sensitive information, as demonstrated by searching for the NoSyncSearchHistory string in .plist files within public Git repositories.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://gitlab.com/gnachman/iterm2/issues/8491

Scores

CVSS v3 7.5

EPSS 0.0142

EPSS Percentile 69.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-200

Status published

Products (1)

iterm2/iterm2 < 3.3.6

Published Nov 17, 2019

Tracked Since Feb 18, 2026