"No code execution on the target system is required, just a memory dump," vdhoney said on GitHub. The researcher who discovered the vulnerability, known as "vdhoney," has already released a proof-of-concept for it on GitHub.
KeePass' maintainer has developed a fix for the flaw, but it will not be generally available until the release of version 2.54, expected in early June. The latest issue, tracked as CVE-2023-32784, affects KeePass 2.X versions on Windows, Linux, and macOS, and enables attackers to obtain a user's master password in cleartext from a memory dump, even when the user's workspace is locked. A security researcher has identified a vulnerability in the popular KeePass open source password manager for the second time in recent months.
0 kommentar(er)
