PT-2024-21369 · Enpass · Enpass Password Manager Desktop Client

Published 2024-04-10 · Updated 2024-07-03 · CVE-2024-26362

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Enpass Password Manager Desktop Client version 6.9.2

Description The issue allows attackers to run arbitrary HTML code via the creation of a crafted note, potentially leading to HTML injection. This can occur in the Enpass Password Manager Desktop Client for both Windows and Linux operating systems.

Recommendations For Enpass Password Manager Desktop Client version 6.9.2, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting the creation of notes to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-26362

Affected Products

Enpass Password Manager Desktop Client

References · 6

• https://osv.dev/vulnerability/CVE-2024-26362 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26362 · Security Note
• https://t.me/cvenotify/76328 · Telegram Post
• https://t.me/cvenotify/76428 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1778200344306082118 · Twitter Post
• https://packetstormsecurity.com/files/177075/Enpass-Desktop-Application-6.9.2-HTML-Injection.html · Note