A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted…

Description

A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted by an attacker, the discovered vulnerability could trigger the Password Manager Extension to fill in the password field automatically. An attacker could then access this information via JavaScript. The issue was fixed with the browser extensions version 2.18.5 for Chrome, MS Edge, Opera, Firefox, and Safari.

Scores

EPSS (exploitation in 30 days)

1.0% · top 36% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

• Sensitive Data Leakage

Affected products

• Avira Password Manager – Browser Extensions

  • affected Avira Password Manager - extension for Chrome
  • affected version 2.18.4.3868 Avira Password Manager - extension for MS Edge
  • affected version 2.18.4.3847 Avira Password Manager - extension for Opera
  • affected version 2.18.4.3847 Avira Password Manager - extension for Firefox
  • affected version 2.18.4.38471 Avira Password Manager - extension for Safari
  • affected version 2.18.4

References (1)

• https://support.norton.com/sp/static/external/tools/security-advisories.html (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-28795](https://trackcve.app/badge/CVE-2022-28795.svg)](https://trackcve.app/cve/CVE-2022-28795)

Record last updated 3 Aug 2024, 06:03 UTC.