CVE-2022-28870 (GCVE-0-2022-28870)

Vulnerability from cvelistv5 – Published: 2022-04-15 10:20 – Updated: 2024-08-03 06:03
VLAI?
Summary
A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing attack with address bar spoofing as the address bar was not correct if navigation fails.
Severity ?
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
CWE
  • Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android
Assigner
References
Impacted products
Vendor Product Version
F-Secure F-Secure Mobile Security Affected: 18.6 , < All Version (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:03:53.215Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.f-secure.com/en/home/support/security-advisories"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.f-secure.com/en/home/support/security-advisories/cve-2022-28870"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Android"
          ],
          "product": "F-Secure Mobile Security",
          "vendor": "F-Secure",
          "versions": [
            {
              "lessThan": "All Version ",
              "status": "affected",
              "version": "18.6",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing attack with address bar spoofing as the address bar was not correct if navigation fails."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-15T10:20:27",
        "orgId": "126858f1-1b65-4b74-81ca-7034f7f7723f",
        "shortName": "F-SecureUS"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.f-secure.com/en/home/support/security-advisories"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.f-secure.com/en/home/support/security-advisories/cve-2022-28870"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "FIX: A fix has been released in the automatic update channel since 13th, April 2022. No user action is required."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-notifications-us@f-secure.com",
          "ID": "CVE-2022-28870",
          "STATE": "PUBLIC",
          "TITLE": "Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "F-Secure Mobile Security",
                      "version": {
                        "version_data": [
                          {
                            "platform": "Android",
                            "version_affected": "\u003c",
                            "version_name": "18.6",
                            "version_value": "All Version "
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "F-Secure"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing attack with address bar spoofing as the address bar was not correct if navigation fails."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.f-secure.com/en/home/support/security-advisories",
              "refsource": "MISC",
              "url": "https://www.f-secure.com/en/home/support/security-advisories"
            },
            {
              "name": "https://www.f-secure.com/en/home/support/security-advisories/cve-2022-28870",
              "refsource": "MISC",
              "url": "https://www.f-secure.com/en/home/support/security-advisories/cve-2022-28870"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "FIX: A fix has been released in the automatic update channel since 13th, April 2022. No user action is required."
          }
        ],
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "126858f1-1b65-4b74-81ca-7034f7f7723f",
    "assignerShortName": "F-SecureUS",
    "cveId": "CVE-2022-28870",
    "datePublished": "2022-04-15T10:20:27",
    "dateReserved": "2022-04-08T00:00:00",
    "dateUpdated": "2024-08-03T06:03:53.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f-secure:safe:*:*:*:*:*:android:*:*\", \"versionEndIncluding\": \"18.6\", \"matchCriteriaId\": \"82709386-E1D2-4681-9CC2-26329E97C843\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing attack with address bar spoofing as the address bar was not correct if navigation fails.\"}, {\"lang\": \"es\", \"value\": \"Se ha detectado una vulnerabilidad que afecta al navegador F-Secure SAFE. Un sitio web dise\\u00f1ado de forma maliciosa pod\\u00eda realizar un ataque de phishing con suplantaci\\u00f3n de la barra de direcciones, ya que \\u00e9sta no era correcta si fallaba la navegaci\\u00f3n\"}]",
      "id": "CVE-2022-28870",
      "lastModified": "2024-11-21T06:58:06.163",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"cve-notifications-us@f-secure.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L\", \"baseScore\": 4.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 0.9, \"impactScore\": 3.4}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N\", \"baseScore\": 4.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 1.4}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:P/A:N\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2022-04-15T11:15:07.927",
      "references": "[{\"url\": \"https://www.f-secure.com/en/home/support/security-advisories\", \"source\": \"cve-notifications-us@f-secure.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.f-secure.com/en/home/support/security-advisories/cve-2022-28870\", \"source\": \"cve-notifications-us@f-secure.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.f-secure.com/en/home/support/security-advisories\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.f-secure.com/en/home/support/security-advisories/cve-2022-28870\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "cve-notifications-us@f-secure.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-28870\",\"sourceIdentifier\":\"cve-notifications-us@f-secure.com\",\"published\":\"2022-04-15T11:15:07.927\",\"lastModified\":\"2024-11-21T06:58:06.163\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing attack with address bar spoofing as the address bar was not correct if navigation fails.\"},{\"lang\":\"es\",\"value\":\"Se ha detectado una vulnerabilidad que afecta al navegador F-Secure SAFE. Un sitio web dise\u00f1ado de forma maliciosa pod\u00eda realizar un ataque de phishing con suplantaci\u00f3n de la barra de direcciones, ya que \u00e9sta no era correcta si fallaba la navegaci\u00f3n\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cve-notifications-us@f-secure.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":0.9,\"impactScore\":3.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f-secure:safe:*:*:*:*:*:android:*:*\",\"versionEndIncluding\":\"18.6\",\"matchCriteriaId\":\"82709386-E1D2-4681-9CC2-26329E97C843\"}]}]}],\"references\":[{\"url\":\"https://www.f-secure.com/en/home/support/security-advisories\",\"source\":\"cve-notifications-us@f-secure.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.f-secure.com/en/home/support/security-advisories/cve-2022-28870\",\"source\":\"cve-notifications-us@f-secure.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.f-secure.com/en/home/support/security-advisories\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.f-secure.com/en/home/support/security-advisories/cve-2022-28870\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.