High severity · published May 14, 2021
CVE-2020-27020
Password generator feature in Kaspersky Password Manager was not completely cryptographically strong and potentially allowed an attacker to predict generated passwords in some…
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
Password generator feature in Kaspersky Password Manager was not completely cryptographically strong and potentially allowed an attacker to predict generated passwords in some cases. An attacker would need to know some additional information (for example, time of password generation).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PM
Password Manager · Kaspersky
before 9.2; before 9.2.14.31; before 9.2.14.872; 9.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-27020
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-27020
Broken Link
https://support.kaspersky.com/general/vulnerability.aspx?el=12430#270421
More from Password Manager
7.8
CVE-2021-35052
A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High
7.8
CVE-2018-6306
Unauthorized code execution from specific DLL and is known as DLL Hijacking attack in Kaspersky Password Manager versions before 8.0.6.538