Click Studios Passwordstate insufficiently protected credentials

published 2022-12-19 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-51943

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 60%
public exploits: 0; none known

A vulnerability has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as problematic. This vulnerability affects unknown code. The manipulation leads to insufficiently protected credentials. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. VDB-216274 is the identifier assigned to this vulnerability.

Patch / fix

fixed in 1

clickstudios passwordstate 9.5

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 18 mo ago (2025-04-14)

Exploit prediction

0.91% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

modzero.com https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html referenced PoC, tagged "exploit" by a source, unverified
modzero.com https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

Click Studios Passwordstate
Click Studios Passwordstate Browser Extension Chrome

Classification

Weakness

CWE-522 Insufficiently Protected Credentials

References

modzero.com /modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html
exploit, third-party-advisory
modzero.com /static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf
exploit, third-party-advisory
vuldb.com /?id.216274
third-party-advisory

Sources

CVE List CVE-2022-4612
NVD CVE-2022-4612

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary