VulnerabilityModified
CVE-2018-12572
Avast Free Antivirus prior to 19.1.2360 stores user credentials in memory upon login, which allows local users to obtain sensitive information by dumping AvastUI.exe application memory and parsing the data.
HIGH 7.8EPSS 0.31%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.31%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Avast Free Antivirus prior to 19.1.2360 stores user credentials in memory upon login, which allows local users to obtain sensitive information by dumping AvastUI.exe application memory and parsing the data.
- CVSS 3.0
- 7.8 HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.31% probability · 24th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-312
- Affected
- avast/free antivirus
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/151590/Avast-Anti-Virus-Local-Credential-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/151590/Avast-Anti-Virus-Local-Credential-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.