Bitdefender SecurePass Psono-Client Cross-Site Scripting Vulnerability

A Cross-Site Scripting (XSS) vulnerability exists in the Psono-Client component of Bitdefender SecurePass. This issue arises from improper sanitization of the URL field in vault entries categorized as website_password and bookmark. An attacker can create a malicious vault entry containing a javascript:URL, or persuade a user to create or import such an entry. When the user interacts with the entry, the application executes the embedded JavaScript within the context of the Psono vault. This exploitation could allow access to the user's password vault and sensitive information.

Impact

Exploitation of this vulnerability enables Cross-Site Scripting, allowing an attacker to execute arbitrary JavaScript in the context of the user's browser, potentially accessing sensitive data in the user's password vault.