Kaspersky Fixes Security Issue in Password Manager Allowing Credentials Recovery

CVE-2023-23349

Summary

A security issue has been identified in Kaspersky Password Manager for Windows that permits a local user to retrieve auto-filled credentials through a memory dump while the KPM extension for Google Chrome is active. To exploit this vulnerability, an attacker can entice a user into interacting with a malicious login form that auto-fills saved credentials from Kaspersky Password Manager. Following this, the attacker must deploy a malware component to extract the specified credentials, which may lead to unauthorized access and compromise of sensitive user information.

References