Plateforme
windows
Composant
keepass-password-safe
Corrigé dans
2.44.1
CVE-2020-37178 describes a denial-of-service (DoS) vulnerability present in KeePass Password Safe versions prior to 2.44. An attacker can exploit this flaw by crafting and dragging malicious HTML files into the application's help system, potentially leading to instability or a complete crash. This vulnerability impacts users running KeePass Password Safe versions 2.44 and earlier.
The primary impact of CVE-2020-37178 is a denial-of-service condition. Successful exploitation allows an attacker to crash the KeePass Password Safe application, preventing legitimate users from accessing their stored passwords. While this vulnerability doesn't directly lead to data exfiltration or unauthorized access, it can disrupt operations and potentially be used as a distraction tactic in a larger attack. The ease of exploitation – simply dragging a file – makes it a relatively low-effort attack vector.
CVE-2020-37178 was publicly disclosed on 2026-02-11. There are currently no known public proof-of-concept exploits available. The EPSS score is likely low, given the lack of public exploitation and the relatively simple nature of the attack. It is not currently listed on the CISA KEV catalog.
Users of KeePass Password Safe who have not upgraded to version 2.44 are at risk. This includes users who rely on KeePass for secure password storage and those who frequently interact with the application's help system, potentially increasing their exposure to malicious HTML files.
• windows / supply-chain:
Get-Process | Where-Object {$_.ProcessName -eq "KeePass.exe"}• windows / supply-chain:
Get-ItemProperty -Path 'HKLM:\SOFTWARE\KeePass' -Name 'Version'• windows / supply-chain: Check Autoruns for unusual entries related to KeePass or its components.
disclosure
Statut de l'Exploit
EPSS
0.03% (percentile 9%)
CISA SSVC
Vecteur CVSS
The primary mitigation for CVE-2020-37178 is to upgrade KeePass Password Safe to version 2.44 or later. This version contains a fix that addresses the vulnerability in the help system's HTML handling. If immediate upgrading is not possible, consider restricting user access to the help system or implementing input validation to prevent the loading of potentially malicious HTML files. There are no specific WAF or proxy rules that can directly mitigate this vulnerability, as it occurs within the application itself.
Actualice KeePass Password Safe a la versión 2.44 o posterior. Esta versión corrige la vulnerabilidad de denegación de servicio al manejar archivos HTML en el sistema de ayuda. Descargue la última versión desde el sitio web oficial de KeePass.
Analyses de vulnérabilités et alertes critiques directement dans votre boîte mail.
CVE-2020-37178 is a denial-of-service vulnerability in KeePass Password Safe versions before 2.44. Attackers can crash the application by dragging malicious HTML files into the help system.
Yes, if you are using KeePass Password Safe version 2.44 or earlier, you are affected by this vulnerability.
Upgrade KeePass Password Safe to version 2.44 or later to resolve the vulnerability.
There are currently no reports of active exploitation of CVE-2020-37178.
Refer to the official KeePass Password Safe website for the advisory and release notes: https://keepass.info/.
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.