CVE-2023-24055

Deeper analysis

KeePass through version 2.53, in its default configuration, is vulnerable to credential disclosure via the application's XML configuration file. An attacker who can write to this file can insert an export trigger that causes the password manager to write stored entries to disk in cleartext, bypassing the normal encryption of the database. The issue is tracked as CWE-312 and carries a CVSS 3.1 score of 5.5, reflecting local access requirements.

An attacker with write access to the KeePass configuration file on a victim's workstation can add the malicious trigger and later retrieve the exported passwords. Because the attack relies on local file-system access rather than remote exploitation or a flaw in the database encryption itself, it is effective only against users whose systems are already partially compromised or who share configuration directories with untrusted accounts. The vendor maintains that the product is not designed to protect credentials against an adversary who already possesses this level of control over the local machine.

Public references consist primarily of vendor forum threads and technical write-ups that restate the vendor's position; no official patch or configuration change is offered. The associated EPSS score has remained near 0.41 since disclosure, indicating sustained but not sharply escalating exploitation interest.