Vulnerability · Published Mar 22, 2024 · Assigned by Kaspersky

CVE-2023-23349

Low 2.2

In plain English

A low-severity security flaw in Kaspersky Password Manager for Windows from Kaspersky. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)2.2Low

Exploit odds (30 days)<0.1%top 99.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Kaspersky has fixed a security issue in Kaspersky Password Manager (KPM) for Windows that allowed a local user to recover the auto-filled credentials from a memory dump when the KPM extension for Google Chrome is used. To exploit the issue, an attacker must trick a user into visiting a login form of a website with the saved credentials, and the KPM extension must autofill these credentials. The attacker must then launch a malware module to steal those specific credentials.

Affected products (as reported)

Vendor	Product	Versions
Kaspersky	Kaspersky Password Manager for Windows	* – before 24.0.0.427

Weakness: CWE-316 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

References

Advisory issued on March 18, 2024 vendor-advisory