Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1wOGY3LTIyZ3EtbTdqOc4AAvXo

Phoenix before 1.6.14 mishandles check_origin wildcarding

socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token.

Permalink: https://github.com/advisories/GHSA-p8f7-22gq-m7j9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wOGY3LTIyZ3EtbTdqOc4AAvXo
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: 10 months ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Identifiers: GHSA-p8f7-22gq-m7j9, CVE-2022-42975
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-42975
• https://github.com/phoenixframework/phoenix/commit/6e7185b33a59e0b1d1c0b4223adf340a73e963ae
• https://hexdocs.pm/phoenix/1.6.14/changelog.html#1-6-14-2022-10-10
• https://github.com/advisories/GHSA-p8f7-22gq-m7j9

Affected Packages