CVE-2022-4611 Click Studios Passwordstate hard-coded credentials

Medium 4.3 Published 19 Dec 2022 Updated 3 Aug 2024

Attackers can exploit hard-coded credentials in Click Studios Passwordstate to bypass security controls and potentially take over accounts.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-4611?

CVE-2022-4611 is a medium-severity vulnerability in Click Studios Passwordstate, published on 19 Dec 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This affects an unknown part. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-216273 was assigned to this vulnerability.

Weakness: CWE-798

Which versions are affected by CVE-2022-4611?

It affects 1 product.

Products include Clickstudios Passwordstate.

How do I fix CVE-2022-4611?

No fix has been published for CVE-2022-4611 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-4611 being exploited?

There is no known exploitation of CVE-2022-4611 in the wild and no public exploit code.

Public exploit code: 2 proofs of concept on GitHub.

Sources

Also known as GHSA-gc6m-vvjp-f3xm.