CVE-2023-36266

Katalog CVE

CVSS 5.5 · Medium EPSS 0,78%

Kerentanan Insufficiently Protected Credentials pada keepersecurity keeper, keepersecurity keeperfill. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Keeper Password Manager for Desktop version 16.10.2 (fixed in 17.2), and the KeeperFill Browser Extensions version 16.5.4 (fixed in 17.2), allows local attackers to gain sensitive information via plaintext password storage in memory after the user is already logged in, and may persist after logout. NOTE: the vendor disputes this for two reasons: the information is inherently available during a logged-in session when the attacker can read from arbitrary memory locations, and information only remains available after logout because of memory-management limitations of web browsers (not because the Keeper technology itself is retaining the information).

Rincian

Terbit di NVD

12 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-522: Insufficiently Protected Credentials

EPSS (30 hari)

0,78% peluang dieksploitasi; lebih tinggi dari 54,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://harkenzo.tlstickle.com/2023-06-12-Keeper-Password-Dumping/ advisory pihak ketiga
• http://packetstormsecurity.com/files/173809/Keeper-Security-Desktop-16.10.2-Browser-Extension-16.5.4-Password-...
• https://docs.keeper.io/en/enterprise-guide/keeper-forcefield
• https://docs.keeper.io/en/release-notes/desktop/web-vault-+-desktop-app/vault-release-17.2