GitHub Advisoryadvisory · Hex

GHSA-p8f7-22gq-m7j9 Phoenix before 1.6.14 mishandles check_origin wildcarding

HIGH Published 2022-10-17 Modified 2024-04-10 Official page ↗
Aliases
CVE-2022-42975
Ecosystem
Hex
Packages
phoenix
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-346, CWE-863
Reviewed
2022-10-18

Affected packages

• Hex phoenix: < 1.6.14 → fixed in 1.6.14

Description

socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token.

Related

Alias · CVE (1)

  • CVE-2022-42975 socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. vulnerability

Weakness · CWE (2)

  • CWE-346 Origin Validation Error weakness
  • CWE-863 Incorrect Authorization weakness

References