What is CVE-2023-36266?

CVE-2023-36266 is a medium-severity vulnerability in Keepersecurity Keeper, classified under Insufficiently Protected Credentials. CVSS score: 5.5/10. Published 2023-07-12.

How severe is CVE-2023-36266?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Is CVE-2023-36266 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Keepersecurity Keeper

CVE-2023-36266

An issue was discovered in Keeper Password Manager for Desktop version 16.10.2 (fixed in 17.2), and the KeeperFill Browser Extensions version 16.5.4 (fixed in 17.2), allows local attackers to gain sensitive information via plaintext password storage in memory after the user is already logged in, and may persist after logout. NOTE: the vendor disputes this for two reasons: the information is inherently available during a logged-in session when the attacker can read from arbitrary memory locations, and information only remains available after logout because of memory-management limitations of web browsers (not because the Keeper technology itself is retaining the information).

EPSS: 0.007 (50.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Keepersecurity Keeper — versions 16.10.2
Keepersecurity Keeperfill — versions 16.5.4
N/a — versions n/a

Weakness classification (CWE)

CWE-522 — Insufficiently Protected Credentials

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2023-36266?: CVE-2023-36266 is a medium-severity vulnerability in Keepersecurity Keeper, classified under Insufficiently Protected Credentials. CVSS score: 5.5/10. Published 2023-07-12.
How severe is CVE-2023-36266?: Medium severity. CVSS v3 base score is 5.5 out of 10.
Is CVE-2023-36266 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.