CVE-2022-4611 : A vulnerability, which was classified as problematic, was found in Click Studios

A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This affects an unknown part. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-216273 was assigned to this vulnerability.

Published 2022-12-19 15:15:10

Updated 2024-05-17 02:16:50

Source VulDB

View at NVD, CVE.org

Products affected by CVE-2022-4611

Clickstudios » Passwordstate
Versions before (<) 9.5
cpe:2.3:a:clickstudios:passwordstate:*:*:*:*:*:*:*:*
Matching versions
Clickstudios » Passwordstate » Version: 9.5 Update Build 9500
cpe:2.3:a:clickstudios:passwordstate:9.5:build_9500:*:*:*:-:*:*
Matching versions
Clickstudios » Passwordstate » Version: 9.5 Update Build 9512
cpe:2.3:a:clickstudios:passwordstate:9.5:build_9512:*:*:*:-:*:*
Matching versions
Clickstudios » Passwordstate » Version: 9.5 Update Build 9519
cpe:2.3:a:clickstudios:passwordstate:9.5:build_9519:*:*:*:-:*:*
Matching versions
Clickstudios » Passwordstate » Version: 9.5 Update Build 9531
cpe:2.3:a:clickstudios:passwordstate:9.5:build_9531:*:*:*:-:*:*
Matching versions
Clickstudios » Passwordstate » Version: 9.5 Update Build 9533
cpe:2.3:a:clickstudios:passwordstate:9.5:build_9533:*:*:*:-:*:*
Matching versions
Clickstudios » Passwordstate » Version: 9.5 Update Build 9535
cpe:2.3:a:clickstudios:passwordstate:9.5:build_9535:*:*:*:-:*:*
Matching versions
Clickstudios » Passwordstate » Version: 9.5 Update Build 9583
cpe:2.3:a:clickstudios:passwordstate:9.5:build_9583:*:*:*:-:*:*
Matching versions
Clickstudios » Passwordstate » Version: 9.5.8.4 For Chrome
cpe:2.3:a:clickstudios:passwordstate:9.5.8.4:*:*:*:*:chrome:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-4611

EPSS FAQ

12.92%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 93 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-4611

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	2.8	1.4	VulDB
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	2.8	1.4	VulDB	2024-02-29
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2022-4611

CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.
Assigned by:
- cna@vuldb.com (Primary)
- nvd@nist.gov (Secondary)

References for CVE-2022-4611

https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html

Better Make Sure Your Password Manager Is Secure | mod%log
Exploit;Third Party Advisory

CVEs referencing this url
https://vuldb.com/?ctiid.216273

Third Party Advisory
https://vuldb.com/?id.216273

CVE-2022-4611 | Click Studios Passwordstate hard-coded credentials
Third Party Advisory

Jump to

Vulnerability Details : CVE-2022-4611

Products affected by CVE-2022-4611

Exploit prediction scoring system (EPSS) score for CVE-2022-4611

CVSS scores for CVE-2022-4611

CWE ids for CVE-2022-4611

References for CVE-2022-4611