Vulnerability in Avira Password Manager

CVE-2022-28795

A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted by an attacker, the discovered vulnerability could trigger the Password Manager Extension to fill in the password field automatically. An attacker could then access this information via JavaScript. The issue was fixed with the browser extensions version 2.18.5 for Chrome, MS Edge, Opera, Firefox, and Safari.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.010 (62.1th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 62nd percentile — 62.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2022-28795: held from 0.010 to 0.010.

EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: +0.000

Affected products

  • Avira Password Manager — versions 2.18.4, 2.18.4.3847, 2.18.4.3868
  • Avira Password Manager – Browser Extensions — versions Avira Password Manager - extension for Chrome, version 2.18.4.3868 Avira Password Manager - extension for MS Edge, version 2.18.4.3847 Avira Password Manager - extension for Opera

References

Frequently asked questions

What is CVE-2022-28795?
CVE-2022-28795 is a medium-severity vulnerability in Avira Password Manager. CVSS score: 6.5/10. Published 2022-04-12.
How severe is CVE-2022-28795?
Medium severity. CVSS v3 base score is 6.5 out of 10.