CVE-2023-24055

Published on: Not Yet Published

Last Modified on: 01/23/2023 03:08:00 PM UTC

CVE-2023-24055

The following vulnerability was found:

** DISPUTED ** KeePass through 2.53 (in a default installation) allows an attacker, who has write access to the XML configuration file, to obtain the cleartext passwords by adding an export trigger. NOTE: the vendor's position is that the password database is not intended to be secure against an attacker who has that level of access to the local PC.

CVE-2023-24055 has been assigned by [email protected] to track the vulnerability

CVE References

Description	Tags ^ⓘ	Link
Just a moment...	sourceforge.net text/html Inactive LinkNot Archived	MISC sourceforge.net/p/keepass/discussion/329220/thread/a146e5cf6b/
Just a moment...	sourceforge.net text/html Inactive LinkNot Archived	MISC sourceforge.net/p/keepass/feature-requests/2773/

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].

There are currently no QIDs associated with this CVE

Exploit/POC from Github

CVE-2023-24055 PoC (KeePass 2.5x)

There are no known software configurations (CPEs) currently associated with this CVE

No vendor comments have been submitted for this CVE

Social Mentions

Source	Title	Posted (UTC)
@CVEreport	CVE-2023-24055 : DISPUTED KeePass through 2.53 in a default installation allows an attacker, who has write… twitter.com/i/web/status/1…	2023-01-22 04:07:18
@InteraxisCA	NVD - CVE-2023-24055: KeePass through 2.53 (in a default installation) allows an attacker, who has write access to… twitter.com/i/web/status/1…	2023-01-22 11:45:32
@threatmeter	CVE-2023-24055 \| KeePass up to 2.53 XML Configuration File missing encryption A vulnerability was found in KeePass… twitter.com/i/web/status/1…	2023-01-22 11:50:35
/r/KeePass	CVE-2023-24055: Keepass vulnerability	2023-01-26 14:15:29
/r/apdm	CVE-2023-24055 : KeePass affecté par une faille critique !	2023-01-27 01:11:27
/r/blueteamsec	CVE-2023-24055 PoC (KeePass 2.5x) - An attacker who has write access to the KeePass configuration file can modify it and inject malicious triggers, e.g to obtain the cleartext passwords by adding an export trigger	2023-01-28 19:43:44