CVE-2023-36266
First published: Wed Jul 12 2023(Updated: )
** DISPUTED ** An issue was discovered in Keeper Password Manager for Desktop version 16.10.2, and the KeeperFill Browser Extensions version 16.5.4, allows local attackers to gain sensitive information via plaintext password storage in memory after the user is already logged in, and may persist after logout. NOTE: the vendor disputes this for two reasons: the information is inherently available during a logged-in session when the attacker can read from arbitrary memory locations, and information only remains available after logout because of memory-management limitations of web browsers (not because the Keeper technology itself is retaining the information).
Credit: H4rk3nz0 cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Keeper Security | =16.10.2 | |
| Keeper Security | =16.5.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-36266?
CVE-2023-36266 has a disputed severity rating due to its potential for local attack vectors that can lead to sensitive data exposure.
How do I fix CVE-2023-36266?
To address CVE-2023-36266, users should update to Keeper Password Manager version 16.10.3 or KeeperFill Browser Extensions version 16.5.5 or later.
What types of software are affected by CVE-2023-36266?
CVE-2023-36266 affects Keeper Password Manager for Desktop version 16.10.2 and KeeperFill Browser Extensions version 16.5.4.
What information can attackers gain through CVE-2023-36266?
Attackers can gain access to sensitive information due to plaintext password storage in memory after a user is logged in.
What is the nature of the vulnerability described in CVE-2023-36266?
CVE-2023-36266 allows local attackers to exploit memory storage to retrieve plaintext passwords stored by the affected applications.
- exploited/true
- collector/exploitdb-recent
- alias/CVE-2023-36266
- agent/type
- agent/first-publish-date
- agent/severity
- agent/references
- agent/author
- agent/weakness
- agent/status
- agent/softwarecombine
- agent/description
- agent/event
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-latest
- collector/nvd-index
- vendor/keepersecurity
- canonical/keeper security
- version/keeper security/16.10.2
- version/keeper security/16.5.4
- status/disputed