Read the docs
TI-2023-09203 Aliases CVE-2023-23349GHSA-m882-67h5-2g42

Kaspersky has fixed a security issue in Kaspersky Password Manager (KPM) for Windows that…

Priority LOW 10CWE-316Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Kaspersky has fixed a security issue in Kaspersky Password Manager (KPM) for Windows that allowed a local user to recover the auto-filled credentials from a memory dump when the KPM extension for Google Chrome is used. To exploit the issue, an attacker must trick a user into visiting a login form of a website with the saved credentials, and the KPM extension must autofill these credentials. The attacker must then launch a malware module to steal those specific credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00093 0th percentileScored 2026-11-07
Fix Fixed Kaspersky Password Manager for Windows (Kaspersky): 24.0.0.427

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KasperskyKaspersky Password Manager for Windowsbefore 24.0.0.42724.0.0.427Patch availableCNA
  • Kaspersky Password Manager for Windows VendorKaspersky Affected before 24.0.0.427 Fixed in 24.0.0.427 Patch available CNA

Remediation

  • Fix · CNA Kaspersky Password Manager for Windows (Kaspersky) Fixed in 24.0.0.427

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-23349
  2. 2026-10-03 Alias added: GHSA-m882-67h5-2g42

References

Advisory 1

  • TI-2012-01284 The ZIP file parser in AhnLab V3 Internet Security 2011.01.18.00, AVG Anti-Virus… CVSS 2.0MEDIUM 4.3
  • TI-2012-01283 The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus… CVSS 2.0MEDIUM 4.3
  • TI-2012-01281 The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir… CVSS 2.0MEDIUM 4.3
  • TI-2012-01279 The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!… CVSS 2.0MEDIUM 4.3
  • TI-2012-01278 The TAR file parser in AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickHeal) 11.00… CVSS 2.0MEDIUM 4.3
  • TI-2012-01275 The CAB file parser in Dr.Web 5.0.2.03300, Trend Micro HouseCall 9.120.0.1004, Kaspersky… CVSS 2.0MEDIUM 4.3
See all 76 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences