Seven security vulnerabilities have been discovered in Click Studios' Passwordstate enterprise password manager that could be exploited to compromise user passwords, according to SecurityWeek.
Click Studios has already remediated the flaws, identified by Modzero researchers, in an update released early last month. Threat actors with Passwordstate usernames could exploit the critical API authentication bypass bug, tracked as CVE-2022-3875, to secure access to users' website credentials, password lists, and one-time passwords. With individuals' usernames, attackers could create a dedicated API token before scanning all password lists and compromising the victim's account with a new cross-site scripting payload, said researchers.
Other vulnerabilities identified by Modzero were given a low- or medium-severity rating.
Passwordstate, which has been used by over 29,000 customers, has been an attractive target for threat actors, with the enterprise password manager being targeted in a supply chain attack in April 2021 that prompted the firm to urge password resets for all users.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.