CVE-2020-27020: kaspersky password_manager Inadequate Encryption Strength

Vulnerability summary

CVE-2020-27020 is a high (CVSS 7.5) Inadequate Encryption Strength vulnerability in kaspersky password_manager. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 53.7% of scored vulnerabilities.

Timeline

1. 14-05-2021
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Password generator feature in Kaspersky Password Manager was not completely cryptographically strong and potentially allowed an attacker to predict generated passwords in some cases. An attacker would need to know some additional information (for example, time of password generation).

• CWE-326Inadequate Encryption StrengthThe product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.