CVE-2022-28795

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-04-12 · updated 2026-06-17

Description

A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted by an attacker, the discovered vulnerability could trigger the Password Manager Extension to fill in the password field automatically. An attacker could then access this information via JavaScript. The issue was fixed with the browser extensions version 2.18.5 for Chrome, MS Edge, Opera, Firefox, and Safari.

Affected products

Avira Password Manager – Browser Extensions: 2.18.4, 2.18.4.3847, 2.18.4.3868, 2.18.4.38471

References

https://support.norton.com/sp/static/external/tools/security-advisories.html
https://support.norton.com/sp/static/external/tools/security-advisories.html

Get alerted when CVE-2022-28795 or the next vulnerability affects your stack