CVE-2023-25428 : A DLL Hijacking issue discovered in Soft-o Free Password Manager 1.1.20 allows a

A DLL Hijacking issue discovered in Soft-o Free Password Manager 1.1.20 allows attackers to create arbitrary DLLs leading to code execution.

Published 2023-05-12 16:15:10

Updated 2023-05-24 16:27:50

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2023-25428

Soft-o » Free Password Manager » Version: 1.1.20
cpe:2.3:a:soft-o:free_password_manager:1.1.20:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 21 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-427 Uncontrolled Search Path Element

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

Assigned by: nvd@nist.gov (Primary)

https://www.soft-o.com/products/free-password-manager.html

Free Password Manager - Password management software
Product
https://packetstormsecurity.com/files/172259/Soft-o-Free-Password-Manager-1.1.20-DLL-Hijacking.html

Soft-o Free Password Manager 1.1.20 DLL Hijacking ≈ Packet Storm
Third Party Advisory;VDB Entry

Jump to