Lucene search

K
nvd[email protected]NVD:CVE-2022-3876
HistoryDec 19, 2022 - 11:15 a.m.

CVE-2022-3876

2022-12-1911:15:10
CWE-266
CWE-639
web.nvd.nist.gov
3
vulnerability
click studios passwordstate
passwordstate browser extension chrome
authorization bypass
remote exploit
upgrade recommended
vdb-216245

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

34.3%

A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This issue affects some unknown processing of the file /api/browserextension/UpdatePassword/ of the component API. The manipulation of the argument PasswordID leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-216245 was assigned to this vulnerability.

Affected configurations

NVD
Node
clickstudiospasswordstateMatch--
OR
clickstudiospasswordstateMatch-chrome

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

34.3%

Related for NVD:CVE-2022-3876