CVE-2022-3875

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-3875
A vulnerability classified as critical was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This vulnerability affects unknown code of the component API. The manipulation leads to authentication bypass by assumed-immutable data. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216244.

7.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html Exploit Technical Description Third Party Advisory
https://vuldb.com/?id.216244 Third Party Advisory VDB Entry
https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf Exploit Third Party Advisory
https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html Exploit Technical Description Third Party Advisory
https://vuldb.com/?id.216244 Third Party Advisory VDB Entry
https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:clickstudios:passwordstate:-:*:*:*:*:-:*:*
cpe:2.3:a:clickstudios:passwordstate:-:*:*:*:*:chrome:*:*
History

21 Nov 2024, 07:20

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad fue encontrada en Click Studios Passwordstate y Passwordstate Browser Extension Chrome y clasificada como crítica. Esta vulnerabilidad afecta a código desconocido de la API del componente. La manipulación conduce a una omisión de autenticación mediante datos supuestamente inmutables. El ataque se puede iniciar de forma remota. La explotación ha sido divulgada al público y puede utilizarse. Se recomienda actualizar el componente afectado. El identificador de esta vulnerabilidad es VDB-216244.
References () https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html - Exploit, Technical Description, Third Party Advisory () https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html - Exploit, Technical Description, Third Party Advisory
References () https://vuldb.com/?id.216244 - Third Party Advisory, VDB Entry () https://vuldb.com/?id.216244 - Third Party Advisory, VDB Entry
References () https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf - Exploit, Third Party Advisory () https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf - Exploit, Third Party Advisory
CVSS v2 : unknown
v3 : 7.5 		v2 : unknown
v3 : 7.3
Information

Published : 2022-12-19 11:15

Updated : 2024-11-21 07:20

NVD link : CVE-2022-3875

Mitre link : CVE-2022-3875

CVE.ORG link : CVE-2022-3875

JSON object : View

Products Affected

clickstudios

  • passwordstate
CWE
CWE-302

Authentication Bypass by Assumed-Immutable Data

CWE-287

Improper Authentication