CVE-2023-32784: High severity keepass vulnerability

Q: What is the vulnerability ID of this vulnerability?

The vulnerability ID is CVE-2023-32784.

Q: What is the severity of CVE-2023-32784?

The severity of CVE-2023-32784 is high with a severity value of 7.5.

Q: What is the affected software of CVE-2023-32784?

The affected software is KeePass 2.x before version 2.54.

Q: Is it possible to recover the cleartext master password from a memory dump with CVE-2023-32784?

Yes, it is possible to recover the cleartext master password from a memory dump with CVE-2023-32784.

Q: How can I fix CVE-2023-32784?

To fix CVE-2023-32784, it is recommended to update KeePass to version 2.54 or later.

Published May 15, 2023

Updated

In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first character cannot be recovered. In 2.54, there is different API usage and/or random string insertion for mitigation.

Affected Software

1 affected component

KeePass KeePass>=2.00<2.54

Event History

May 15, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the vulnerability ID of this vulnerability?

The vulnerability ID is CVE-2023-32784.

What is the severity of CVE-2023-32784?

The severity of CVE-2023-32784 is high with a severity value of 7.5.

What is the affected software of CVE-2023-32784?

The affected software is KeePass 2.x before version 2.54.

Is it possible to recover the cleartext master password from a memory dump with CVE-2023-32784?

Yes, it is possible to recover the cleartext master password from a memory dump with CVE-2023-32784.

How can I fix CVE-2023-32784?