CVE-2022-28795

{"id": "CVE-2022-28795", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2022-04-12T17:15:10.940", "references": [{"url": "https://support.norton.com/sp/static/external/tools/security-advisories.html", "tags": ["Third Party Advisory"], "source": "security@nortonlifelock.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted by an attacker, the discovered vulnerability could trigger the Password Manager Extension to fill in the password field automatically. An attacker could then access this information via JavaScript. The issue was fixed with the browser extensions version 2.18.5 for Chrome, MS Edge, Opera, Firefox, and Safari."}, {"lang": "es", "value": "Una vulnerabilidad en las extensiones de navegador de Avira Password Manager ofrec\u00eda una posible laguna en la que, si un usuario visitaba una p\u00e1gina dise\u00f1ada por un atacante, la vulnerabilidad detectada pod\u00eda hacer que la extensi\u00f3n de Password Manager rellenara el campo de la contrase\u00f1a autom\u00e1ticamente. Un atacante podr\u00eda entonces acceder a esta informaci\u00f3n por medio de JavaScript. El problema ha sido corregido con la versi\u00f3n 2.18.5 de las extensiones del navegador para Chrome, MS Edge, Opera, Firefox y Safari"}], "lastModified": "2022-04-20T14:35:52.933", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:avira:password_manager:2.18.4:*:*:*:*:safari:*:*", "vulnerable": true, "matchCriteriaId": "036D4EFA-5735-4CDC-927E-FDAFFC20AD58"}, {"criteria": "cpe:2.3:a:avira:password_manager:2.18.4.3847:*:*:*:*:edge:*:*", "vulnerable": true, "matchCriteriaId": "914F107C-0D3D-426A-803E-09F302F126FA"}, {"criteria": "cpe:2.3:a:avira:password_manager:2.18.4.3847:*:*:*:*:opera:*:*", "vulnerable": true, "matchCriteriaId": "704A646E-ACD2-46D4-B380-8DD8BEE11FD9"}, {"criteria": "cpe:2.3:a:avira:password_manager:2.18.4.3868:*:*:*:*:chrome:*:*", "vulnerable": true, "matchCriteriaId": "67A7F636-3C8C-48AD-965A-9F21A48FD607"}, {"criteria": "cpe:2.3:a:avira:password_manager:2.18.4.38471:*:*:*:*:firefox:*:*", "vulnerable": true, "matchCriteriaId": "0804892E-24B4-4F8C-9E8B-1FE1FD899A2C"}], "operator": "OR"}]}], "sourceIdentifier": "security@nortonlifelock.com"}