CVE-2023-24055: Medium severity keepass vulnerability
DISPUTED KeePass through 2.53 (in a default installation) allows an attacker, who has write access to the XML configuration file, to obtain the cleartext passwords by adding an export trigger. NOTE: the vendor's position is that the password database is not intended to be secure against an attacker who has that level of access to the local PC.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-24055?
CVE-2023-24055 is a vulnerability in the KeePass password manager that allows an attacker with write access to the XML configuration file to obtain cleartext passwords by adding an export trigger.
What is the severity of CVE-2023-24055?
The severity of CVE-2023-24055 is medium with a severity value of 5.5.
How does CVE-2023-24055 affect KeePass?
CVE-2023-24055 affects KeePass versions up to 2.53 in a default installation.
How can an attacker exploit CVE-2023-24055?
An attacker with write access to the XML configuration file can exploit CVE-2023-24055 by adding an export trigger to obtain cleartext passwords.
Is there a fix available for CVE-2023-24055?
At the time of writing, there is no known fix available for CVE-2023-24055. Users are advised to update to the latest version of KeePass when a fix becomes available.