Vulnerability Details : CVE-2023-32784
In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first character cannot be recovered. In 2.54, there is different API usage and/or random string insertion for mitigation.
Products affected by CVE-2023-32784
- cpe:2.3:a:keepass:keepass:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-32784
0.14%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 50 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-32784
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2023-32784
-
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.Assigned by: nvd@nist.gov (Primary)
References for CVE-2023-32784
-
https://github.com/keepassxreboot/keepassxc/discussions/9433
CVE-2023-32784 : is KeepassXC affected ? · keepassxreboot/keepassxc · Discussion #9433 · GitHubIssue Tracking
-
https://github.com/vdohney/keepass-password-dumper
GitHub - vdohney/keepass-password-dumperExploit;Third Party Advisory
-
https://sourceforge.net/p/keepass/discussion/329220/thread/f3438e6283/
KeePass / Discussion / Open Discussion: Security - Dumping Master Password from Memory, Even When LockedIssue Tracking
Jump to