Lucene search

GitHub Advisory DatabaseGHSA-P8F7-22GQ-M7J9

HistoryOct 17, 2022 - 12:00 p.m.

Phoenix before 1.6.14 mishandles check_origin wildcarding

2022-10-1712:00:27

CWE-346

GitHub Advisory Database

github.com

phoenix

1.6.14

check_origin

wildcarding

liveview

csrf

token

software

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

31.8%

JSON

socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token.

Affected configurations

Vulners

Node

phoenixframeworkphoenixRange<1.6.14

VendorProductVersionCPE
phoenixframeworkphoenix*cpe:2.3:a:phoenixframework:phoenix:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
phoenixframework	phoenix	*	cpe:2.3:a:phoenixframework:phoenix::::::::

References

github.com/advisories/GHSA-p8f7-22gq-m7j9

github.com/phoenixframework/phoenix/commit/6e7185b33a59e0b1d1c0b4223adf340a73e963ae

hexdocs.pm/phoenix/1.6.14/changelog.html#1-6-14-2022-10-10

nvd.nist.gov/vuln/detail/CVE-2022-42975

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

31.8%

JSON

Related for GHSA-P8F7-22GQ-M7J9