CVE-2023-23349

Published Mar 22, 2024 CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed

Description

Kaspersky has fixed a security issue in Kaspersky Password Manager (KPM) for Windows that allowed a local user to recover the auto-filled credentials from a memory dump when the KPM extension for Google Chrome is used. To exploit the issue, an attacker must trick a user into visiting a login form of a website with the saved credentials, and the KPM extension must autofill these credentials. The attacker must then launch a malware module to steal those specific credentials.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Kaspersky

Kaspersky Password Manager for Windows

unaffected

Version	Status	Constraints
`*`	affected	< 24.0.0.427

No data.

No data available yet.

Remediation

Vendor Solution

Install Kaspersky Password Manager (KPM) version 24.0.0.427 or later using the following url: https://support.kaspersky.com/help/KPM/Win24.0/en-US/85241.htm

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2023-27449	Kaspersky has fixed a security issue in Kaspersky Password Manager (KPM) for Windows that allowed a local user to recover the auto-filled credentials from a memory dump when the KPM extension for Google Chrome is used. To exploit the issue, an attacker must trick a user into visiting a login form of a website with the saved credentials, and the KPM extension must autofill these credentials. The attacker must then launch a malware module to steal those specific credentials.