CVE-2022-28868 - Vulnerability Details - OpenCVE

An Address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially crafted malicious webpage/URL, user may be tricked for a short period of time (until the page loads) to think content may be coming from a valid domain, while the content comes from the attacker controlled site.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
F-secure	Safe

Configuration 1 [-]

cpe:2.3:a:f-secure:safe:*:*:*:*:*:android:*:*

No data.

References

Link	Providers
https://www.f-secure.com/en/home/support/security-advisories
https://www.f-secure.com/en/home/support/security-advisories/cve-2022-28868

History

No history.

MITRE

Status: PUBLISHED

Assigner: F-SecureUS

Published: 2022-04-15T10:21:09

Updated: 2024-08-03T06:03:53.153Z

Reserved: 2022-04-08T00:00:00

Link: CVE-2022-28868

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-04-15T11:15:07.727

Modified: 2024-11-21T06:58:05.897

Link: CVE-2022-28868

Redhat

No data.

{"containers": {"cna": {"affected": [{"platforms": ["Android"], "product": "F-Secure Mobile Security", "vendor": "F-Secure", "versions": [{"lessThan": "All Version ", "status": "affected", "version": "18.6", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "An Address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially crafted malicious webpage/URL, user may be tricked for a short period of time (until the page loads) to think content may be coming from a valid domain, while the content comes from the attacker controlled site."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-04-15T10:21:09", "orgId": "126858f1-1b65-4b74-81ca-7034f7f7723f", "shortName": "F-SecureUS"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.f-secure.com/en/home/support/security-advisories"}, {"tags": ["x_refsource_MISC"], "url": "https://www.f-secure.com/en/home/support/security-advisories/cve-2022-28868"}], "solutions": [{"lang": "en", "value": "FIX: A fix has been released in the automatic update channel since 13th, April 2022. No user action is required."}], "source": {"discovery": "EXTERNAL"}, "title": "Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve-notifications-us@f-secure.com", "ID": "CVE-2022-28868", "STATE": "PUBLIC", "TITLE": "Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "F-Secure Mobile Security", "version": {"version_data": [{"platform": "Android", "version_affected": "<", "version_name": "18.6", "version_value": "All Version "}]}}]}, "vendor_name": "F-Secure"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An Address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially crafted malicious webpage/URL, user may be tricked for a short period of time (until the page loads) to think content may be coming from a valid domain, while the content comes from the attacker controlled site."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android"}]}]}, "references": {"reference_data": [{"name": "https://www.f-secure.com/en/home/support/security-advisories", "refsource": "MISC", "url": "https://www.f-secure.com/en/home/support/security-advisories"}, {"name": "https://www.f-secure.com/en/home/support/security-advisories/cve-2022-28868", "refsource": "MISC", "url": "https://www.f-secure.com/en/home/support/security-advisories/cve-2022-28868"}]}, "solution": [{"lang": "en", "value": "FIX: A fix has been released in the automatic update channel since 13th, April 2022. No user action is required."}], "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T06:03:53.153Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.f-secure.com/en/home/support/security-advisories"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.f-secure.com/en/home/support/security-advisories/cve-2022-28868"}]}]}, "cveMetadata": {"assignerOrgId": "126858f1-1b65-4b74-81ca-7034f7f7723f", "assignerShortName": "F-SecureUS", "cveId": "CVE-2022-28868", "datePublished": "2022-04-15T10:21:09", "dateReserved": "2022-04-08T00:00:00", "dateUpdated": "2024-08-03T06:03:53.153Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f-secure:safe:*:*:*:*:*:android:*:*", "matchCriteriaId": "82709386-E1D2-4681-9CC2-26329E97C843", "versionEndIncluding": "18.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An Address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially crafted malicious webpage/URL, user may be tricked for a short period of time (until the page loads) to think content may be coming from a valid domain, while the content comes from the attacker controlled site."}, {"lang": "es", "value": "Se ha detectado una vulnerabilidad de suplantaci\u00f3n de la barra de direcciones en Safe Browser para Android. Cuando el usuario hace clic en una p\u00e1gina web/URL maliciosa especialmente dise\u00f1ada, el usuario puede ser enga\u00f1ado durante un corto per\u00edodo de tiempo (hasta que la p\u00e1gina es cargada) para pensar que el contenido puede venir de un dominio v\u00e1lido, mientras que el contenido proviene del sitio controlado por el atacante"}], "id": "CVE-2022-28868", "lastModified": "2024-11-21T06:58:05.897", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 3.4, "source": "cve-notifications-us@f-secure.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-15T11:15:07.727", "references": [{"source": "cve-notifications-us@f-secure.com", "tags": ["Vendor Advisory"], "url": "https://www.f-secure.com/en/home/support/security-advisories"}, {"source": "cve-notifications-us@f-secure.com", "tags": ["Vendor Advisory"], "url": "https://www.f-secure.com/en/home/support/security-advisories/cve-2022-28868"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.f-secure.com/en/home/support/security-advisories"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.f-secure.com/en/home/support/security-advisories/cve-2022-28868"}], "sourceIdentifier": "cve-notifications-us@f-secure.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}