{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-3206", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "assignerShortName": "WPScan", "dateUpdated": "2023-07-24T10:04:18.387Z", "dateReserved": "2022-09-13T00:00:00", "datePublished": "2022-10-17T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2023-07-24T10:04:18.387Z"}, "title": "Passster < 3.5.5.5.2 - Insecure Storage of Password", "problemTypes": [{"descriptions": [{"description": "CWE-522 Insufficiently Protected Credentials", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"description": "CWE-319 Cleartext Transmission of Sensitive Information", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Passster", "versions": [{"status": "affected", "versionType": "custom", "version": "0", "lessThan": "3.5.5.5.2"}], "defaultStatus": "unaffected", "collectionURL": "https://wordpress.org/plugins"}], "descriptions": [{"lang": "en", "value": "The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named \"passster\" using base64 encoding method which is easy to decode. This puts the password at risk in case the cookies get leaked."}], "references": [{"url": "https://wpscan.com/vulnerability/a8963750-62bf-403e-a906-94f371ed2a7a", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Raad Haddad of Cloudyrion GmbH", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:passster_project:passster:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "CEA1E5C5-FE4A-4488-B0E0-0C931E87946C", "versionEndExcluding": "3.5.5.5.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named \"passster\" using base64 encoding method which is easy to decode. This puts the password at risk in case the cookies get leaked."}, {"lang": "es", "value": "El plugin Passster de WordPress versiones anteriores a 3.5.5.2, almacena la contrase\u00f1a dentro de una cookie llamada \"passster\" usando el m\u00e9todo de codificaci\u00f3n base64 que es f\u00e1cil de decodificar. Esto pone en riesgo la contrase\u00f1a en caso de que las cookies sean filtradas"}], "id": "CVE-2022-3206", "lastModified": "2023-11-07T03:50:58.763", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-10-17T12:15:10.530", "references": [{"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/a8963750-62bf-403e-a906-94f371ed2a7a"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-319"}, {"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}