What’s Vulnerable › Vulnerabilities

CVE-2022-4610: Click Studios Passwordstate risky encryption

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-12-19 · updated 2026-06-17
• Weakness: CWE-310

Description

A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected by this issue is some unknown functionality. The manipulation leads to risky cryptographic algorithm. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-216272.

Affected products

• Click Studios Passwordstate: before 9.5; 9.5-build_9500, 9.5-build_9512, 9.5-build_9519, 9.5-build_9531, 9.5-build_9533, 9.5-build_9535 (+2) — fixed in 9.5

How to fix

Upgrade to a fixed version: Click Studios Passwordstate 9.5. Check the vendor advisory for mitigations.

References

• https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html
• https://vuldb.com/?id.216272
• https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf
• https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html
• https://vuldb.com/?id.216272
• https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf

Get alerted when CVE-2022-4610 or the next vulnerability affects your stack