CVE-2022-0725
HIGHCVSS 7.5/10EPSS 2.41%
Last modified
CVE-2022-0725 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability. EPSS estimates a 2.41% chance of exploitation in the next 30 days.
Description
A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability. This flaw allows an attacker to interact and read sensitive passwords and logs.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Keepass | Keepass | 2.48 |
| Fedoraproject | Extra Packages For Enterprise Linux | 7.0 |
| Fedoraproject | Fedora | 35 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2052696Issue Tracking, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2052696Issue Tracking, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-0725?
A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability. This flaw allows an attacker to interact and read sensitive passwords and logs.
How severe is CVE-2022-0725?
CVE-2022-0725 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 2.41% probability of exploitation in the next 30 days.
How do I fix CVE-2022-0725?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-0719Cross-site Scripting (XSS) - Reflected in GitHub repository …5.4
- CVE-2022-0720The Amelia WordPress plugin before 1.0.47 does not have prop…5.4
- CVE-2022-0721Insertion of Sensitive Information Into Debugging Code in Gi…6.5
- CVE-2022-0722Exposure of Sensitive Information to an Unauthorized Actor i…7.5
- CVE-2022-0723Cross-site Scripting (XSS) - Reflected in GitHub repository …5.4
- CVE-2022-0724Insecure Storage of Sensitive Information in GitHub reposito…6.5
- CVE-2022-0726Missing Authorization in GitHub repository chocobozzz/peertu…5.4
- CVE-2022-0727Improper Access Control in GitHub repository chocobozzz/peer…5.4
- CVE-2022-0728The Easy Smooth Scroll Links WordPress plugin before 2.23.1 …4.8
- CVE-2022-0729Use of Out-of-range Pointer Offset in GitHub repository vim/…8.8
- CVE-2022-0730Under certain ldap conditions, Cacti authentication can be b…9.8
- CVE-2022-0731Improper Access Control (IDOR) in GitHub repository dolibarr…6.5
Are you affected by CVE-2022-0725?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST