KeePass through 2.53 (in a default installation) allows an attacker, who has write access to the XML configuration file, to obtain the cleartext passwords by adding an export trigger. NOTE: the vendor's position is that the password database is not intended to be secure against an attacker who has that level of access to the local PC.
References
| Link | Resource |
|---|---|
| https://securityboulevard.com/2023/01/keepass-password-manager-leak-cve-richixbw/ | Third Party Advisory |
| https://sourceforge.net/p/keepass/discussion/329220/thread/a146e5cf6b/ | Patch Third Party Advisory |
| https://sourceforge.net/p/keepass/feature-requests/2773/ | Third Party Advisory |
Configurations
History
07 Nov 2023, 04:08
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | KeePass through 2.53 (in a default installation) allows an attacker, who has write access to the XML configuration file, to obtain the cleartext passwords by adding an export trigger. NOTE: the vendor's position is that the password database is not intended to be secure against an attacker who has that level of access to the local PC. |
29 Aug 2023, 17:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://securityboulevard.com/2023/01/keepass-password-manager-leak-cve-richixbw/ - Third Party Advisory |
Information
Published : 2023-01-22 04:15
Updated : 2024-08-02 11:16
NVD link : CVE-2023-24055
Mitre link : CVE-2023-24055
CVE.ORG link : CVE-2023-24055
JSON object : View
Products Affected
keepass
- keepass
CWE
CWE-312
Cleartext Storage of Sensitive Information