High severity · published Mar 17, 2019
CVE-2018-12572
Avast Free Antivirus prior to 19.1.2360 stores user credentials in memory upon login, which allows local users to obtain sensitive information by dumping AvastUI.exe application…
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
Avast Free Antivirus prior to 19.1.2360 stores user credentials in memory upon login, which allows local users to obtain sensitive information by dumping AvastUI.exe application memory and parsing the data.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
Free Antivirus · Avast
before 19.1.2360 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-12572
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-12572
Exploit
http://packetstormsecurity.com/files/151590/Avast-Anti-Virus-Local-Credential-Disclosure.html
More from Free Antivirus
7.8
CVE-2024-7233
Avast Free Antivirus AvastSvc Link Following Local Privilege Escalation Vulnerability
7.8
CVE-2024-7232
Avast Free Antivirus AvastSvc Link Following Local Privilege Escalation Vulnerability
7.8
CVE-2024-7227
Avast Free Antivirus AvastSvc Link Following Local Privilege Escalation Vulnerability
6.7
CVE-2017-5567
Code injection vulnerability in Avast Premier 12.3 (and earlier), Internet Security 12.3 (and earlier), Pro Antivirus 12.3 (and earlier), and Free Antivirus 12.3 (and earlier)…
5.5
CVE-2024-7228
Avast Free Antivirus Link Following Denial-of-Service Vulnerability