Vulnerability advisory

CVE-2022-42975

Published Oct 17, 2022Updated Oct 28, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/phoenixframework/phoenix ↗
All commits before 50b4854124fc52cfa4666b2e555f984532d372e9	`50b4854124fc52cfa4666b2e555f984532d372e9`
Not specified	`6e7185b33a59e0b1d1c0b4223adf340a73e963ae`
Also listed as affected (67) `v1.6.13` `v1.6.12` `v1.6.11` `v1.6.10` `v1.6.7` `v1.6.6` `v1.6.5` `v1.6.4` `v1.6.3` `v1.6.2` `v1.6.1` `v1.6.0` `v1.6.0-rc.1` `v1.6.0-rc.0` `v1.5.0` `v1.5.0-rc.0` `v1.4.0` `v1.4.0-rc.3` `v1.4.0-rc.2` `v1.4.0-rc.1` `v1.4.0-rc.0` `v1.3.0` `v1.3.0-rc.3` `v1.3.0-rc.2` `v1.3.0-rc.1` `v1.3.0-rc.0` `v1.2.0` `v1.2.0-rc.1` `v1.2.0-rc.0` `v1.1.3` `v1.1.2` `v1.1.1` `v1.1.0` `v1.0.3` `v1.0.2` `v1.0.1` `v1.0.0` `v0.17.1` `v0.17.0` `v0.16.1` `v0.16.0` `v0.15.0` `v0.14.0` `v0.13.1` `v0.13.0` `v0.12.0` `v0.11.0` `v0.10.0` `v0.9.0` `v0.8.0` `v0.7.2` `v0.7.1` `v0.7.0` `v0.6.1` `v0.6.0` `v0.5.0` `v0.4.1` `v0.4.0` `v0.3.1` `v0.3.0` `v0.2.11` `v0.2.10` `v0.2.3` `v0.2.2` `v0.2.1` `v0.2.0` `v0.1.1`

Description

socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token.

CVE-2022-42975

Affected versions

Repository

Description

References