CVEvulnerability

CVE-2023-47801

4.7 MEDIUM Published 2023-11-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-11-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.7 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-732

Description

An issue was discovered in Click Studios Passwordstate before 9811. Existing users (Security Administrators) could use the System Wide API Key to read or delete private password records when specifically used with the PasswordHistory API endpoint. It is also possible to use the Copy/Move Password Record API Key to Copy/Move private password records.

Affected configurations

• clickstudios passwordstate (< 9.8)

Related

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References