Passster
CVE-2022-3206
MEDIUM
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. This puts the password at risk in case the cookies get leaked.
AnalysisAI
The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-319. The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. This puts the password at risk in case the cookies get leaked. Affected products include: Passster Project Passster. Version information: before 3.5.5.5.2.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Password-protected block content in the Passster WordPress plugin (all versions before 4.3.6) is rendered into the publi
Category-locked content in the Passster WordPress plugin (all versions before 4.3.6) is fully exposed through the native
Unauthenticated content disclosure in the Passster WordPress plugin (versions before 4.3.6) allows any remote user to re
Passster WordPress plugin versions before 4.3.9 exposes globally password-protected post and page content to unauthentic
Global protection bypass in the Passster WordPress plugin (versions before 4.2.26) allows unauthenticated remote attacke
Unauthenticated information disclosure in the Passster WordPress plugin (versions before 4.2.24) allows remote attackers
The Passster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content_protector shortc
The Passster - Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure i
Broken access control in the Passster WordPress content-protection plugin (versions up to and including 4.3.13) allows u
The Passster - Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure i
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today