cve/2023/CVE-2023-23349.md

### [CVE-2023-23349](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23349)
![](https://img.shields.io/static/v1?label=Product&message=Kaspersky%20Password%20Manager%20for%20Windows&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=*%3C%2024.0.0.427%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-316%3A%20Cleartext%20Storage%20of%20Sensitive%20Information%20in%20Memory&color=brighgreen)

### Description

Kaspersky has fixed a security issue in Kaspersky Password Manager (KPM) for Windows that allowed a local user to recover the auto-filled credentials from a memory dump when the KPM extension for Google Chrome is used. To exploit the issue, an attacker must trick a user into visiting a login form of a website with the saved credentials, and the KPM extension must autofill these credentials. The attacker must then launch a malware module to steal those specific credentials.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/NaInSec/CVE-LIST