PT-2022-24561 · Click Studios · Click Studios Passwordstate+1

Constantin Müller + 2 · Published 2022-12-19 · Updated 2022-12-28 · CVE-2022-3877

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Click Studios Passwordstate (affected versions not specified) Click Studios Passwordstate Browser Extension Chrome (affected versions not specified)

Description A problematic vulnerability was found in the component URL Field Handler of Click Studios Passwordstate and Passwordstate Browser Extension Chrome. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations Upgrade the affected component to a newer version. As a temporary workaround, consider restricting access to the URL Field Handler component until a patch is available. Avoid using the vulnerable URL Field Handler component in Click Studios Passwordstate and Passwordstate Browser Extension Chrome until the issue is resolved.

Exploit

Fix

Improper Neutralization

XSS

Weakness Enumeration

CWE-707

CWE-79

Related Identifiers

CVE-2022-3877

Affected Products

Click Studios Passwordstate

Passwordstate Browser Extension Chrome

References · 7

• 🔥 https://modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf · Exploit
• 🔥 https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-3877 · Security Note
• https://t.me/cybersecuritytechnologies/7411 · Telegram Post
• https://t.me/cibsecurity/54846 · Telegram Post
• https://vuldb.com/?id.216246 · Note
• https://t.me/cvenotify/40153 · Telegram Post