VulnerabilityDeferred

CVE-2020-37178

KeePass Password Safe versions before 2.44 contain a denial of service vulnerability in the help system's HTML handling.

MEDIUM 4.6EPSS 0.29%

Does this matter?

Lower severity and a low EPSS score (0.29%). Track it; it rarely justifies an emergency change on its own.

Description

KeePass Password Safe versions before 2.44 contain a denial of service vulnerability in the help system's HTML handling. Attackers can trigger the vulnerability by dragging and dropping malicious HTML files into the help area, potentially causing application instability or crash.

CVSS 4.0: 4.6 MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.29% probability · 22th percentile
CISA KEV: Not listed
Weakness: CWE-94
Source: disclosure@vulncheck.com

References

https://keepass.info/
https://www.exploit-db.com/exploits/47952
https://www.vulncheck.com/advisories/keepass-denial-of-service-poc

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.