PT-2022-17374 · Click Studios · Passwordstate

Published 2022-03-21 · Updated 2022-06-15 · CVE-2022-25570

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Click Studios (SA) Pty Ltd Passwordstate version 9435

Description The issue allows users with access to a password list to gain access to additional password lists without permissions. Specifically, an authenticated user who has write permissions to a password list in one folder, with the default permission model, can extend their permissions to all other password lists in the same folder.

Recommendations For Click Studios (SA) Pty Ltd Passwordstate version 9435, consider restricting access to password lists and reviewing the default permission model to minimize the risk of exploitation. As a temporary workaround, consider disabling write permissions to password lists in sensitive folders until a patch is available.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2022-25570

Affected Products

Passwordstate

References · 6

• 🔥 https://sysadms.de/2022/03/cve-2022-25570-standard-berechtigungsmodell-im-passwortmanager-passwordstate-ermoeglicht-rechteausweitung · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-25570 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25570 · Vendor Advisory
• https://t.me/cvenotify/28291 · Telegram Post
• https://t.me/cibsecurity/39305 · Telegram Post
• https://clickstudios.com.au/passwordstate-changelog.aspx · Note