5.5

CVE-2023-24055

KeePass through 2.53 (in a default installation) allows an attacker, who has write access to the XML configuration file, to obtain the cleartext passwords by adding an export trigger. NOTE: the vendor's position is that the password database is not intended to be secure against an attacker who has that level of access to the local PC.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Keepass ≫ Keepass Version <= 2.53
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.69% 0.884
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CWE-312 Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

https://securityboulevard.com/2023/01/keepass-password-manager-leak-cve-richixbw/
Third Party Advisory
https://sourceforge.net/p/keepass/discussion/329220/thread/a146e5cf6b/
Patch
Third Party Advisory
https://sourceforge.net/p/keepass/feature-requests/2773/
Third Party Advisory