CVE-2022-4610 (GCVE-0-2022-4610)
Vulnerability from cvelistv5
Published
2022-12-19 00:00
Modified
2025-04-15 12:56
Severity ?
1.9 (Low) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-310 - Cryptographic Issues -> CWE-327 Risky Cryptographic Algorithm
Summary
A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected by this issue is some unknown functionality. The manipulation leads to risky cryptographic algorithm. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-216272.
References
Impacted products
Vendor Product Version
Click Studios Passwordstate Version: n/a
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:48:38.943Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.216272"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-4610",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-14T16:54:31.766304Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-15T12:56:37.245Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Passwordstate",
          "vendor": "Click Studios",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        },
        {
          "product": "Passwordstate Browser Extension Chrome",
          "vendor": "Click Studios",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Constantin M\u00fcller/Jan Benninger/Pascal Zenker"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected by this issue is some unknown functionality. The manipulation leads to risky cryptographic algorithm. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-216272."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 1.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-310",
              "description": "CWE-310 Cryptographic Issues -\u003e CWE-327 Risky Cryptographic Algorithm",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-19T00:00:00.000Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "url": "https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html"
        },
        {
          "url": "https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf"
        },
        {
          "url": "https://vuldb.com/?id.216272"
        }
      ],
      "title": "Click Studios Passwordstate risky encryption",
      "x_generator": "vuldb.com"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2022-4610",
    "datePublished": "2022-12-19T00:00:00.000Z",
    "dateReserved": "2022-12-19T00:00:00.000Z",
    "dateUpdated": "2025-04-15T12:56:37.245Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-4610\",\"sourceIdentifier\":\"cna@vuldb.com\",\"published\":\"2022-12-19T15:15:10.247\",\"lastModified\":\"2024-11-21T07:35:35.630\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected by this issue is some unknown functionality. The manipulation leads to risky cryptographic algorithm. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-216272.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad clasificada como problem\u00e1tica ha sido encontrada en Click Studios Passwordstate y Passwordstate Browser Extension Chrome. Una funci\u00f3n desconocida es afectada por este problema. La manipulaci\u00f3n conduce a un algoritmo criptogr\u00e1fico arriesgado. Se requiere acceso local para abordar este ataque. El exploit ha sido divulgado al p\u00fablico y puede utilizarse. El identificador de esta vulnerabilidad es VDB-216272.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":1.9,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":0.5,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-310\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-327\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:clickstudios:passwordstate:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"9.5\",\"matchCriteriaId\":\"33EF0704-7BE3-48EB-8F0A-02101FBA158C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:clickstudios:passwordstate:9.5:build_9500:*:*:*:-:*:*\",\"matchCriteriaId\":\"53FFDC0B-0F74-494D-9CBE-2DAC27B040EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:clickstudios:passwordstate:9.5:build_9512:*:*:*:-:*:*\",\"matchCriteriaId\":\"86308402-59E4-4F27-BF2B-B5C3E4DC4A95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:clickstudios:passwordstate:9.5:build_9519:*:*:*:-:*:*\",\"matchCriteriaId\":\"7B3EBBD3-EBFF-4A7E-9425-1DCF431DE4F1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:clickstudios:passwordstate:9.5:build_9531:*:*:*:-:*:*\",\"matchCriteriaId\":\"D4BB7778-9669-43A2-9E72-7EE2CC8EDB51\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:clickstudios:passwordstate:9.5:build_9533:*:*:*:-:*:*\",\"matchCriteriaId\":\"5E41BACC-4F74-4A9A-9C8B-B1FF661B3B70\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:clickstudios:passwordstate:9.5:build_9535:*:*:*:-:*:*\",\"matchCriteriaId\":\"B0EFF8C9-3F2C-454E-811D-257FA41C6CDD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:clickstudios:passwordstate:9.5:build_9583:*:*:*:-:*:*\",\"matchCriteriaId\":\"C0B5D5D0-3DEC-4492-BED9-C5267C4BA281\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:clickstudios:passwordstate:9.5.8.4:*:*:*:*:chrome:*:*\",\"matchCriteriaId\":\"8CFF9226-D49B-42F9-A553-B3F6FD8413C3\"}]}]}],\"references\":[{\"url\":\"https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://vuldb.com/?id.216272\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://vuldb.com/?id.216272\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Click Studios Passwordstate risky encryption\", \"providerMetadata\": {\"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\", \"dateUpdated\": \"2022-12-19T00:00:00.000Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected by this issue is some unknown functionality. The manipulation leads to risky cryptographic algorithm. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-216272.\"}], \"affected\": [{\"vendor\": \"Click Studios\", \"product\": \"Passwordstate\", \"versions\": [{\"version\": \"n/a\", \"status\": \"affected\"}]}, {\"vendor\": \"Click Studios\", \"product\": \"Passwordstate Browser Extension Chrome\", \"versions\": [{\"version\": \"n/a\", \"status\": \"affected\"}]}], \"references\": [{\"url\": \"https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html\"}, {\"url\": \"https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf\"}, {\"url\": \"https://vuldb.com/?id.216272\"}], \"credits\": [{\"lang\": \"en\", \"value\": \"Constantin M\\u00fcller/Jan Benninger/Pascal Zenker\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\", \"baseScore\": 1.9, \"baseSeverity\": \"LOW\"}}], \"problemTypes\": [{\"descriptions\": [{\"type\": \"CWE\", \"lang\": \"en\", \"description\": \"CWE-310 Cryptographic Issues -\u003e CWE-327 Risky Cryptographic Algorithm\", \"cweId\": \"CWE-310\"}]}], \"x_generator\": \"vuldb.com\"}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T01:48:38.943Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://vuldb.com/?id.216272\", \"tags\": [\"x_transferred\"]}]}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-4610\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-14T16:54:31.766304Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-14T16:54:33.495Z\"}}]}",
      "cveMetadata": "{\"state\": \"PUBLISHED\", \"cveId\": \"CVE-2022-4610\", \"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"assignerShortName\": \"VulDB\", \"dateUpdated\": \"2025-04-15T12:56:37.245Z\", \"dateReserved\": \"2022-12-19T00:00:00.000Z\", \"datePublished\": \"2022-12-19T00:00:00.000Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.