What is CVE-2022-28795?

CVE-2022-28795 is a medium-severity vulnerability in Avira Password Manager. CVSS score: 6.5/10. Published 2022-04-12.

How severe is CVE-2022-28795?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Avira Password Manager

CVE-2022-28795

A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted by an attacker, the discovered vulnerability could trigger the Password Manager Extension to fill in the password field automatically. An attacker could then access this information via JavaScript. The issue was fixed with the browser extensions version 2.18.5 for Chrome, MS Edge, Opera, Firefox, and Safari.

EPSS: 0.010 (58.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.

Affected products

Avira Password_manager — versions 2.18.4, 2.18.4.3847, 2.18.4.3868
N/a Avira Password Manager – Browser Extensions — versions Avira Password Manager - extension for Chrome, version 2.18.4.3868 Avira Password Manager - extension for MS Edge, version 2.18.4.3847 Avira Password Manager - extension for Opera

References

security@nortonlifelock.com (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2022-28795?: CVE-2022-28795 is a medium-severity vulnerability in Avira Password Manager. CVSS score: 6.5/10. Published 2022-04-12.
How severe is CVE-2022-28795?: Medium severity. CVSS v3 base score is 6.5 out of 10.