Shulou(Shulou.com)11/24 Report--

CTOnews.com May 18 news, a network expert named "vdohney" recently found a vulnerability in the password management tool KeePass, tracking number CVE-2023-32784, which can retrieve the master password of the software in memory.

The bad news is that KeePass officials have not fixed this vulnerability, and the good news is that hackers cannot remotely extract passwords by exploiting this vulnerability. Security experts also publicly released the KeePass 2.x Master Password Dumper proof-of-concept tool.

CTOnews.com translated the content of the expert as follows:

If your computer is already infected with malware running in the background with user privileges, it may not have much impact on you.

If someone can access your computer and do forensic analysis, then in the worst case, the attacker can know your master password.

This vulnerability affects the KeePass 2.x branch that applies to Windows, as well as Linux and macOS. The vulnerability has been fixed in the test version of KeePass v2.54 and is expected to be released in July 2023.

Note: KeepassXC is not affected. It is a branch of KeepassX and a cross-platform port for KeePass

Related readings:

"password management tool KeePass exposed security vulnerability: allows an attacker to export the entire database in plain text"

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.