CVE-2022-0725 Information disclosure in keepass
An attacker can read sensitive passwords from system logs due to plain text logging in KeePass.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-0725?
CVE-2022-0725 is a high-severity vulnerability in Fedoraproject Extra Packages for Enterprise Linux, published on 7 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability. This flaw allows an attacker to interact and read sensitive passwords and logs.
Which versions are affected by CVE-2022-0725?
It affects 3 products.
Products include Fedoraproject Extra Packages for Enterprise Linux, Fedoraproject Fedora, Keepass Keepass.
How do I fix CVE-2022-0725?
No fix has been published for CVE-2022-0725 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-0725 being exploited?
There is no known exploitation of CVE-2022-0725 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Fedoraproject Extra Packages for Enterprise Linux
- CVE-2023-34152 Command injection in ImageMagick
- CVE-2022-4170 Code injection in rxvt-unicode
- CVE-2022-40315 Moodle Minor SQL injection risk in admin user browsing
- CVE-2022-45152 Moodle blind Server-Side Request Forgery (SSRF) vulnerability in LTI provider library
- CVE-2022-24882 Server side NTLM does not properly check parameters in FreeRDP
All Fedoraproject Extra Packages for Enterprise Linux vulnerabilities
Sources
Also known as GHSA-4p6x-85ff-qrhc, UBUNTU-CVE-2022-0725.