PT-2022-27754 · Click Studios · Click Studios Passwordstate Browser Extension Chrome+1

Constantin Müller + 2 · Published 2022-12-19 · Updated 2023-06-23 · CVE-2022-4613

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Click Studios Passwordstate (affected versions not specified) Click Studios Passwordstate Browser Extension Chrome (affected versions not specified)

Description A critical issue affects the Browser Extension Provisioning component, leading to improper authorization. The attack can be initiated remotely. It is estimated that an unknown number of devices may be affected.

Recommendations To resolve the issue, upgrade the affected component. As a temporary workaround, consider restricting access to the Browser Extension Provisioning component until a patch is available.

Exploit

Fix

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2022-4613

Affected Products

Click Studios Passwordstate

Click Studios Passwordstate Browser Extension Chrome

References · 7

• 🔥 https://modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf · Exploit
• 🔥 https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html · Exploit
• https://osv.dev/vulnerability/CVE-2022-4613 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4613 · Security Note
• https://t.me/cvenotify/40559 · Telegram Post
• https://t.me/cibsecurity/54884 · Telegram Post
• https://vuldb.com/?id.216275 · Note