CVE-2023-32784 Information disclosure in n/a
Attackers with memory access can recover cleartext master passwords from KeePass memory dumps, compromising all stored credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-32784?
CVE-2023-32784 is a high-severity vulnerability in n/a, published on 15 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first character cannot be recovered. In 2.54, there is different API usage and/or random string insertion for mitigation.
Weakness: CWE-319
Which versions are affected by CVE-2023-32784?
It affects 1 product.
Linux distribution packages (5)
keepass SUSE:Package Hub 15 SP4 | All versions | 2.54-bp154.2.3.1 |
keepass SUSE:Package Hub 15 SP5 | All versions | 2.54-bp155.2.3.1 |
keepass openSUSE:Leap 15.4 | All versions | 2.54-bp154.2.3.1 |
keepass openSUSE:Leap 15.5 | All versions | 2.54-bp155.2.3.1 |
keepass openSUSE:Tumbleweed | All versions | 2.54-1.1 |
Products include Keepass Keepass.
How do I fix CVE-2023-32784?
Upgrade to a fixed version.
Is CVE-2023-32784 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-32784 exists.
Public exploit code: 14 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2023-32784, GHSA-f4c7-5p8v-p7jh, UBUNTU-CVE-2023-32784, openSUSE-SU-2023:0157-1, openSUSE-SU-2023:0163-1, openSUSE-SU-2024:12982-1.