Vulnerability · Published Oct 17, 2022 · Assigned by WPScan
CVE-2022-3206Passster < 3.5.5.5.2 - Insecure Storage of Password
Medium 5.9
In plain English
A medium-severity security flaw in Passster from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.6%top 51.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. This puts the password at risk in case the cookies get leaked.
Affected products (as reported)
References
- https://wpscan.com/vulnerability/a8963750-62bf-403e-a906-94f371ed2a7a exploit, vdb-entry, technical-description