CVE-2022-0725

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-0725
A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability. This flaw allows an attacker to interact and read sensitive passwords and logs.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=2052696 Issue Tracking Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:keepass:keepass:2.48:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
History

13 Sep 2022, 14:15

Type Values Removed Values Added
Summary A flaw was found in KeePass. The vulnerability occurs due to logging the plain text passwords in the system log and leads to an Information Exposure vulnerability. This flaw allows an attacker to interact and read sensitive passwords and logs. A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability. This flaw allows an attacker to interact and read sensitive passwords and logs.
References
  • {'url': 'https://github.com/ByteHackr/keepass_poc', 'name': 'https://github.com/ByteHackr/keepass_poc', 'tags': ['Exploit', 'Third Party Advisory'], 'refsource': 'MISC'}

14 Jun 2022, 14:38

Type Values Removed Values Added
CPE cpe:2.3:a:fedoraproject:fedora_extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:* cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:*
First Time Fedoraproject extra Packages For Enterprise Linux

06 Apr 2022, 14:23

Type Values Removed Values Added
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2052696 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2052696 - Issue Tracking, Third Party Advisory

16 Mar 2022, 15:15

Type Values Removed Values Added
References
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2052696 -

15 Mar 2022, 18:09

Type Values Removed Values Added
First Time Fedoraproject fedora
Keepass
Keepass keepass
Fedoraproject fedora Extra Packages For Enterprise Linux
Fedoraproject
CWE CWE-532
CVSS v2 : unknown
v3 : unknown 		v2 : 5.0
v3 : 7.5
CPE cpe:2.3:a:keepass:keepass:2.48:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:fedora_extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:*
References (MISC) https://github.com/ByteHackr/keepass_poc - (MISC) https://github.com/ByteHackr/keepass_poc - Exploit, Third Party Advisory

10 Mar 2022, 17:54

Type Values Removed Values Added
New CVE
Information

Published : 2022-03-10 17:44

Updated : 2023-12-10 14:22

NVD link : CVE-2022-0725

Mitre link : CVE-2022-0725

CVE.ORG link : CVE-2022-0725

JSON object : View

Products Affected

fedoraproject

  • fedora
  • extra_packages_for_enterprise_linux

keepass

  • keepass
CWE
CWE-532

Insertion of Sensitive Information into Log File

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor