CVE-2022-28795

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 12-04-2022 07:15

Last modified: - 20-04-2022 04:35

Total changes: - 2

Description

A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted by an attacker, the discovered vulnerability could trigger the Password Manager Extension to fill in the password field automatically. An attacker could then access this information via JavaScript. The issue was fixed with the browser extensions version 2.18.5 for Chrome, MS Edge, Opera, Firefox, and Safari.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Low

Attack complexity

Network

Attack vector

None

Availability

High

Confidentiality

None

Integrity

None

Privileges required

Unchanged

Scope

Required

User interaction

6.5

Base score

2.8

3.6

Exploitability score

Impact score

Verification logic

vendor=avira AND product=password_manager AND version=2.18.4 AND target_software=safari

vendor=avira AND product=password_manager AND version=2.18.4.3847 AND target_software=edge

vendor=avira AND product=password_manager AND version=2.18.4.3847 AND target_software=opera

vendor=avira AND product=password_manager AND version=2.18.4.3868 AND target_software=chrome

vendor=avira AND product=password_manager AND version=2.18.4.38471 AND target_software=firefox

Reference

https://support.norton.com/sp/static/external/tools/security-advisories.html

Keywords

CVE-2022-28795

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2022-28795

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures