Jan Benninger

A critical vulnerability was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome, affecting the component API. The manipulation leads to authentication bypass by assumed-immutable data, and the attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Researchers discovered seven types of vulnerabilities, including problems related to authentication and authorization bypass, incorrect password protection, hardcoded credentials, and XSS vulnerability. The vulnerability may allow an unauthenticated attacker to extract user passwords. Given the product's wide adoption, including by Fortune 500 companies, Passwordstate is a frequent target for hackers.

A problematic issue has been found in the API component, affecting the processing of the file /api/browserextension/UpdatePassword/. The manipulation of the `PasswordID` argument leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

A problematic vulnerability was found in the component URL Field Handler of Click Studios Passwordstate and Passwordstate Browser Extension Chrome. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

A problematic vulnerability has been found, affecting some unknown functionality. The manipulation leads to the use of a risky cryptographic algorithm. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.

A problematic vulnerability was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome, affecting an unknown part. The manipulation leads to hard-coded credentials and can be initiated remotely. The exploit has been disclosed to the public and may be used.

A vulnerability has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome, classified as problematic. This issue affects unknown code, leading to insufficiently protected credentials. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

A critical issue affects the Browser Extension Provisioning component, leading to improper authorization. The attack can be initiated remotely. It is estimated that an unknown number of devices may be affected.