CVE-2023-32784

PoC —

CVSS 3.1

7.5 high

EPSS

4%p91

Published

May 15, 2023 (May 15, 2023)

Modified

Jun 17, 2026

Description

In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first character cannot be recovered. In 2.54, there is different API usage and/or random string insertion for mitigation.

Vendors: keepass
Products: keepass
Weakness: CWE-319
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (4.4%)

In the news7 stories

Security Affairs newsletter Round 420 by Pierluigi Paganini

Security AffairsMay 21, 13:07 UTC · May 21, 2023Ransomware in the wildCVE-2023-32784

60

Week in review: KeePass vulnerability, Apple fixes exploited WebKit 0-days

Help Net SecurityMay 21, 00:00 UTC · May 21, 2023Vulnerability in the wildCVE-2023-28204 CVE-2023-32373 CVE-2023-32409+1 CVEs

60

KeePass Exploit Allows Attackers to Recover Master Passwords from Memory

The Hacker NewsJun 6, 03:48 UTC · Jun 6, 2023Exploit / PoC CVE-2023-32784 CVE-2023-24055

50

KeePass flaw allows retrieval of master password, PoC is public (CVE-2023-32784)

Help Net SecurityJun 5, 18:33 UTC · Jun 5, 2023Exploit / PoC CVE-2023-32784

50

KeePass fixed bug that allows extraction of cleartext master pwd

Security AffairsJun 5, 18:24 UTC · Jun 5, 2023Exploit / PoC CVE-2023-32784

50

KeePass Flaw Exposes Master Passwords

Infosecurity MagazineMay 19, 17:00 UTC · May 19, 2023Exploit / PoC CVE-2023-32784

50

KeePass 2.X Master Password Dumper allows retrieving the KeePass master password

Security AffairsMay 18, 20:17 UTC · May 18, 2023Exploit / PoC CVE-2023-32784

50