CVE-2023-35866
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database session, without the need to authenticate these changes by entering the password and/or second-factor authentication to confirm changes.
Risk Assessment
A local attacker can change critical security settings, potentially leading to unauthorized access to sensitive data stored in the database.
Recommendation
It is recommended to update KeePassXC to the latest version to mitigate the risk associated with this vulnerability and consider additional security measures to protect data.
Original NVD description (English source)
In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database session, without the need to authenticate these changes by entering the password and/or second-factor authentication to confirm changes. NOTE: the vendor's position is "asking the user for their password prior to making any changes to the database settings adds no additional protection against a local attacker."