PT-2022-19244 · Avira · Avira Password Manager Browser Extensions

Published 2022-04-12 · Updated 2022-04-20 · CVE-2022-28795

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Avira Password Manager Browser Extensions versions prior to 2.18.5

Description A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted by an attacker, the discovered vulnerability could trigger the Password Manager Extension to fill in the password field automatically. An attacker could then access this information via JavaScript.

Recommendations For Avira Password Manager Browser Extensions versions prior to 2.18.5, update to version 2.18.5 or later to resolve the issue. As a temporary workaround, consider disabling the automatic password filling feature in the Password Manager Extension until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2022-28795

Affected Products

Avira Password Manager Browser Extensions

References · 5

• https://osv.dev/vulnerability/CVE-2022-28795 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28795 · Security Note
• https://t.me/cibsecurity/40645 · Telegram Post
• https://support.norton.com/sp/static/external/tools/security-advisories.html · Note
• https://t.me/cvenotify/29207 · Telegram Post