CVE-2023-47131 is a high severity flaw in the N-able PassPortal browser extension, scored 7.5. Versions before 3.29.2 insert sensitive information into a log file. Update the extension to 3.29.2 or later, and review who can read the logs it wrote.
What's affected
The NVD record says the N-able PassPortal extension for Chrome before 3.29.2 inserts sensitive information into a log file. The CPE list also names Chrome, Edge and Firefox, so check the extension in every browser you manage.
The fixed version is 3.29.2, taken from the record. N-able's own advisory is listed as a reference, but my fetch only returned a loading page, so I could not read the vendor text. Check the advisory for details on what was logged and where.
The score reflects a network vector with high confidentiality impact and no integrity or availability impact. In plain terms, the risk is disclosure of data that should not have been written to a log.
The NVD record was published on 2024-02-08, scores 7.5 (High), and carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Weakness class: CWE-532.
How to check if you're exposed
Check the installed extension version in each browser.
- In Chrome, open chrome://extensions and find PassPortal.
- In Edge, open edge://extensions.
- In Firefox, open about:addons.
If you manage browsers centrally, use your endpoint management tool to list extension versions across the fleet. Anything below 3.29.2 needs an update. Then ask whether logs or diagnostic output from the old version were collected or shared, for example in support tickets.
What to do now
- Update the PassPortal extension to 3.29.2 or later on every managed browser.
- Confirm that automatic extension updates are enabled in your browser policy.
- Find diagnostic bundles and support attachments created while an old version ran, and handle them as sensitive.
- Read the N-able advisory to learn exactly what the log could contain.
- Rotate any credential the advisory says may have been logged.
Why it matters
Writing sensitive data into logs is CWE-532. Logs are copied around for troubleshooting, kept for a long time, and read by more people than the system that wrote them. A secret that lands in a log escapes the protections around the original store.
For a credential management extension, the stakes are higher than for a typical app, because the data handled is the keys to other systems. The record's KEV flag is false, so this CVE is not on the CISA Known Exploited Vulnerabilities list.
The fix stops new entries. It does not clean up old ones, so look for log files, bug reports and backups made before the update.
Quick check
Does updating the extension remove old logs?
No. The update stops the logging. Old log files and any copies shared for support need to be found and handled separately.
Sources
Last reviewed: 19 October 2026.
