CVE-2022-46695

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-46695
A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Visiting a website that frames malicious content may lead to UI spoofing.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://seclists.org/fulldisclosure/2022/Dec/20 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Dec/21 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Dec/23 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Dec/26 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Dec/27
https://support.apple.com/en-us/HT213530 Release Notes Vendor Advisory
https://support.apple.com/en-us/HT213531 Release Notes Vendor Advisory
https://support.apple.com/en-us/HT213532 Release Notes Vendor Advisory
https://support.apple.com/en-us/HT213535 Release Notes Vendor Advisory
https://support.apple.com/en-us/HT213536 Release Notes Vendor Advisory
http://seclists.org/fulldisclosure/2022/Dec/20 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Dec/21 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Dec/23 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Dec/26 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2022/Dec/27
https://support.apple.com/en-us/HT213530 Release Notes Vendor Advisory
https://support.apple.com/en-us/HT213531 Release Notes Vendor Advisory
https://support.apple.com/en-us/HT213532 Release Notes Vendor Advisory
https://support.apple.com/en-us/HT213535 Release Notes Vendor Advisory
https://support.apple.com/en-us/HT213536 Release Notes Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
History

21 Nov 2024, 07:30

Type Values Removed Values Added
Summary
  • (es) Existía un problema de suplantación de identidad en el manejo de las URL. Este problema se solucionó con una validación de entrada mejorada. Este problema se solucionó en tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 y iPadOS 15.7.2, iOS 16.2 y iPadOS 16.2, watchOS 9.2. Visitar un sitio web que enmarque contenido malicioso puede provocar una suplantación de la interfaz de usuario.
References () http://seclists.org/fulldisclosure/2022/Dec/20 - Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2022/Dec/20 - Mailing List, Third Party Advisory
References () http://seclists.org/fulldisclosure/2022/Dec/21 - Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2022/Dec/21 - Mailing List, Third Party Advisory
References () http://seclists.org/fulldisclosure/2022/Dec/23 - Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2022/Dec/23 - Mailing List, Third Party Advisory
References () http://seclists.org/fulldisclosure/2022/Dec/26 - Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2022/Dec/26 - Mailing List, Third Party Advisory
References () http://seclists.org/fulldisclosure/2022/Dec/27 - () http://seclists.org/fulldisclosure/2022/Dec/27 -
References () https://support.apple.com/en-us/HT213530 - Release Notes, Vendor Advisory () https://support.apple.com/en-us/HT213530 - Release Notes, Vendor Advisory
References () https://support.apple.com/en-us/HT213531 - Release Notes, Vendor Advisory () https://support.apple.com/en-us/HT213531 - Release Notes, Vendor Advisory
References () https://support.apple.com/en-us/HT213532 - Release Notes, Vendor Advisory () https://support.apple.com/en-us/HT213532 - Release Notes, Vendor Advisory
References () https://support.apple.com/en-us/HT213535 - Release Notes, Vendor Advisory () https://support.apple.com/en-us/HT213535 - Release Notes, Vendor Advisory
References () https://support.apple.com/en-us/HT213536 - Release Notes, Vendor Advisory () https://support.apple.com/en-us/HT213536 - Release Notes, Vendor Advisory
Information

Published : 2022-12-15 19:15

Updated : 2025-04-21 15:15

NVD link : CVE-2022-46695

Mitre link : CVE-2022-46695

CVE.ORG link : CVE-2022-46695

JSON object : View

Products Affected

apple

  • ipados
  • tvos
  • macos
  • iphone_os
  • watchos
CWE
CWE-1021

Improper Restriction of Rendered UI Layers or Frames