2

CVE-2023-24055 is a known vulnerability that enables an attacker to recover plaintext user credentials from the KeePass application.

However, due to the original KeePass being Windows-specific, I've been using a compatible "KeePass XC" for quite some time, and I'm sure there're other people that does the same.

So the question, is CVE-2023-24055 applicable to "KeePass XC" and other password managers using compatible password database formats?

Improve this question
1
  • This is mostly a non vulnerability. An attacker in position to perform this attack can perform much more.
    – Bruno Rohée
    Feb 8 at 13:32

1 Answer 1

Reset to default
2

It appears KeepassXC is not affected. From "Statement on CVE-2023-24055? #9041" https://github.com/keepassxreboot/keepassxc/issues/9041#issuecomment-1408260822

KeePassXC is not affected, because it doesn't support triggers.

Taking a quick look through the main unlock routines DatabaseTabWidget::addDatabaseTab and DatabaseOpenWidget::openDatabase, and there's nothing that indicates some sort of scripted automation.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .