CVE-2023-24055

Published on: Not Yet Published

Last Modified on: 01/23/2023 03:08:00 PM UTC

The following vulnerability was found:

** DISPUTED ** KeePass through 2.53 (in a default installation) allows an attacker, who has write access to the XML configuration file, to obtain the cleartext passwords by adding an export trigger. NOTE: the vendor's position is that the password database is not intended to be secure against an attacker who has that level of access to the local PC.

CVE References

Description Tags Link
Just a moment... sourceforge.net
text/html
Inactive LinkNot Archived
URL Logo MISC sourceforge.net/p/keepass/discussion/329220/thread/a146e5cf6b/
Just a moment... sourceforge.net
text/html
Inactive LinkNot Archived
URL Logo MISC sourceforge.net/p/keepass/feature-requests/2773/

Exploit/POC from Github

CVE-2023-24055 PoC (KeePass 2.5x)

Social Mentions

Source Title Posted (UTC)
Twitter Icon @CVEreport CVE-2023-24055 : ** DISPUTED ** KeePass through 2.53 in a default installation allows an attacker, who has write… twitter.com/i/web/status/1… 2023-01-22 04:07:18
Twitter Icon @InteraxisCA NVD - CVE-2023-24055: KeePass through 2.53 (in a default installation) allows an attacker, who has write access to… twitter.com/i/web/status/1… 2023-01-22 11:45:32
Twitter Icon @threatmeter CVE-2023-24055 | KeePass up to 2.53 XML Configuration File missing encryption A vulnerability was found in KeePass… twitter.com/i/web/status/1… 2023-01-22 11:50:35
Reddit Logo Icon /r/KeePass CVE-2023-24055: Keepass vulnerability 2023-01-26 14:15:29
Reddit Logo Icon /r/apdm CVE-2023-24055 : KeePass affecté par une faille critique ! 2023-01-27 01:11:27
Reddit Logo Icon /r/blueteamsec CVE-2023-24055 PoC (KeePass 2.5x) - An attacker who has write access to the KeePass configuration file can modify it and inject malicious triggers, e.g to obtain the cleartext passwords by adding an export trigger 2023-01-28 19:43:44
© CVE.report 2023 Twitter Nitter Twitter Viewer |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report