2

CVE-2023-24055 is a known vulnerability that enables an attacker to recover plaintext user credentials from the KeePass application.

However, due to the original KeePass being Windows-specific, I've been using a compatible "KeePass XC" for quite some time, and I'm sure there're other people that does the same.

So the question, is CVE-2023-24055 applicable to "KeePass XC" and other password managers using compatible password database formats?

1
  • This is mostly a non vulnerability. An attacker in position to perform this attack can perform much more. Commented Feb 8, 2023 at 13:32

1 Answer 1

2

It appears KeepassXC is not affected. From "Statement on CVE-2023-24055? #9041" https://github.com/keepassxreboot/keepassxc/issues/9041#issuecomment-1408260822

KeePassXC is not affected, because it doesn't support triggers.

Taking a quick look through the main unlock routines DatabaseTabWidget::addDatabaseTab and DatabaseOpenWidget::openDatabase, and there's nothing that indicates some sort of scripted automation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .