CVE-2022-4612 : A vulnerability has been found in Click Studios Passwordstate and Passwordstate

A vulnerability has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as problematic. This vulnerability affects unknown code. The manipulation leads to insufficiently protected credentials. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. VDB-216274 is the identifier assigned to this vulnerability.

Published 2022-12-19 15:15:10

Updated 2022-12-23 21:23:43

Source VulDB

View at NVD, CVE.org

Products affected by CVE-2022-4612

Clickstudios » Passwordstate
Versions before (<) 9.5
cpe:2.3:a:clickstudios:passwordstate:*:*:*:*:*:*:*:*
Matching versions
Clickstudios » Passwordstate » Version: 9.5 Update Build 9500
cpe:2.3:a:clickstudios:passwordstate:9.5:build_9500:*:*:*:-:*:*
Matching versions
Clickstudios » Passwordstate » Version: 9.5 Update Build 9512
cpe:2.3:a:clickstudios:passwordstate:9.5:build_9512:*:*:*:-:*:*
Matching versions
Clickstudios » Passwordstate » Version: 9.5 Update Build 9519
cpe:2.3:a:clickstudios:passwordstate:9.5:build_9519:*:*:*:-:*:*
Matching versions
Clickstudios » Passwordstate » Version: 9.5 Update Build 9531
cpe:2.3:a:clickstudios:passwordstate:9.5:build_9531:*:*:*:-:*:*
Matching versions
Clickstudios » Passwordstate » Version: 9.5 Update Build 9533
cpe:2.3:a:clickstudios:passwordstate:9.5:build_9533:*:*:*:-:*:*
Matching versions
Clickstudios » Passwordstate » Version: 9.5 Update Build 9535
cpe:2.3:a:clickstudios:passwordstate:9.5:build_9535:*:*:*:-:*:*
Matching versions
Clickstudios » Passwordstate » Version: 9.5 Update Build 9583
cpe:2.3:a:clickstudios:passwordstate:9.5:build_9583:*:*:*:-:*:*
Matching versions
Clickstudios » Passwordstate » Version: 9.5.8.4 For Chrome
cpe:2.3:a:clickstudios:passwordstate:9.5.8.4:*:*:*:*:chrome:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-4612

EPSS FAQ

0.13%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 48 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-4612

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	2.8	1.4	VulDB
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2022-4612

CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Assigned by: cna@vuldb.com (Primary)

References for CVE-2022-4612

https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html

Better Make Sure Your Password Manager Is Secure | mod%log
Exploit;Third Party Advisory

CVEs referencing this url
https://vuldb.com/?id.216274

CVE-2022-4612 | Click Studios Passwordstate insufficiently protected credentials
Third Party Advisory
https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf

Exploit;Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-4612

Products affected by CVE-2022-4612

Exploit prediction scoring system (EPSS) score for CVE-2022-4612

CVSS scores for CVE-2022-4612

CWE ids for CVE-2022-4612

References for CVE-2022-4612