CVE-2023-43295

Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in Click Studios (SA) Pty Ltd Passwordstate in Build 9785 and earlier versions. The vulnerability allows an attacker to forge requests that, when executed by an authenticated user, can lead to arbitrary code execution. [1]

Exploitation

A local attacker can craft a malicious request and trick an authenticated user into executing it. The attacker does not need authentication but relies on the victim's session. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary code with the privileges of the victim user, potentially leading to complete compromise of the affected Passwordstate instance. [1]

Mitigation

As of the available reference, no patch or mitigation details have been disclosed for this vulnerability. Users are advised to monitor the vendor's security advisories page for updates. [1]