What is CVE-2020-27020?

CVE-2020-27020 is a high-severity vulnerability in Kaspersky Password Manager, classified under Inadequate Encryption Strength. CVSS score: 7.5/10. Published 2021-05-14.

How severe is CVE-2020-27020?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Kaspersky Password Manager

CVE-2020-27020

Password generator feature in Kaspersky Password Manager was not completely cryptographically strong and potentially allowed an attacker to predict generated passwords in some cases. An attacker would need to know some additional information (for example, time of password generation).

EPSS: 0.007 (50.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Kaspersky Password_manager — versions 9.2
N/a Kaspersky Password Manager For Windows, Android, Ios — versions KPM for Windows prior to 9.2 Patch F, KPM for Android prior to 9.2.14.872, KPM for iOS prior to 9.2.14.31

Weakness classification (CWE)

CWE-326 — Inadequate Encryption Strength

References

vulnerability@kaspersky.com (x_refsource_MISC, Broken Link)

Frequently asked questions

What is CVE-2020-27020?: CVE-2020-27020 is a high-severity vulnerability in Kaspersky Password Manager, classified under Inadequate Encryption Strength. CVSS score: 7.5/10. Published 2021-05-14.
How severe is CVE-2020-27020?: High severity. CVSS v3 base score is 7.5 out of 10.