CVE-2022-2165 - Vulnerability Details - OpenCVE

ReportizFlow

Insufficient data validation in URL formatting in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Fedoraproject	Fedora
Google	Chrome

Configuration 1 [-]

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR	cpe:2.3:o:fedoraproject:fedora:35:::::::*
	cpe:2.3:o:fedoraproject:fedora:36:::::::*

No data.

References

Link	Providers
https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop_21.html
https://crbug.com/1250993
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BQRTR4SIUNIHLLPWTGYSDNQK7DYCRSB/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H2C4XOJVIILDXTOSMWJXHSQNEXFWSOD7/
https://security.gentoo.org/glsa/202208-25

History

No history.

MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2022-07-28T00:41:15

Updated: 2024-08-03T00:32:07.964Z

Reserved: 2022-06-21T00:00:00

Link: CVE-2022-2165

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-07-28T01:15:17.107

Modified: 2024-11-21T07:00:27.547

Link: CVE-2022-2165

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Chrome", "vendor": "Google", "versions": [{"lessThan": "103.0.5060.53", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Insufficient data validation in URL formatting in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name."}], "problemTypes": [{"descriptions": [{"description": "Insufficient data validation", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-08-14T22:12:56", "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop_21.html"}, {"tags": ["x_refsource_MISC"], "url": "https://crbug.com/1250993"}, {"name": "FEDORA-2022-0102ccc2a2", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BQRTR4SIUNIHLLPWTGYSDNQK7DYCRSB/"}, {"name": "FEDORA-2022-1d3d5a0341", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H2C4XOJVIILDXTOSMWJXHSQNEXFWSOD7/"}, {"name": "GLSA-202208-25", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/202208-25"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2022-2165", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Chrome", "version": {"version_data": [{"version_affected": "<", "version_value": "103.0.5060.53"}]}}]}, "vendor_name": "Google"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Insufficient data validation in URL formatting in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Insufficient data validation"}]}]}, "references": {"reference_data": [{"name": "https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop_21.html", "refsource": "MISC", "url": "https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop_21.html"}, {"name": "https://crbug.com/1250993", "refsource": "MISC", "url": "https://crbug.com/1250993"}, {"name": "FEDORA-2022-0102ccc2a2", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/5BQRTR4SIUNIHLLPWTGYSDNQK7DYCRSB/"}, {"name": "FEDORA-2022-1d3d5a0341", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/H2C4XOJVIILDXTOSMWJXHSQNEXFWSOD7/"}, {"name": "GLSA-202208-25", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/202208-25"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:32:07.964Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop_21.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://crbug.com/1250993"}, {"name": "FEDORA-2022-0102ccc2a2", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BQRTR4SIUNIHLLPWTGYSDNQK7DYCRSB/"}, {"name": "FEDORA-2022-1d3d5a0341", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H2C4XOJVIILDXTOSMWJXHSQNEXFWSOD7/"}, {"name": "GLSA-202208-25", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/202208-25"}]}]}, "cveMetadata": {"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "assignerShortName": "Chrome", "cveId": "CVE-2022-2165", "datePublished": "2022-07-28T00:41:15", "dateReserved": "2022-06-21T00:00:00", "dateUpdated": "2024-08-03T00:32:07.964Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "matchCriteriaId": "F575CAC7-F591-41FE-A176-3C08B882C93E", "versionEndExcluding": "103.0.5060.53", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*", "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*", "matchCriteriaId": "5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Insufficient data validation in URL formatting in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name."}, {"lang": "es", "value": "Una comprobaci\u00f3n insuficiente de datos en URL formatting en Google Chrome versiones anteriores a 103.0.5060.53, permit\u00eda a un atacante remoto llevar a cabo una suplantaci\u00f3n de dominio mediante hom\u00f3grafos de IDN por medio de un nombre de dominio dise\u00f1ado"}], "id": "CVE-2022-2165", "lastModified": "2024-11-21T07:00:27.547", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "[email protected]", "type": "Primary"}]}, "published": "2022-07-28T01:15:17.107", "references": [{"source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop_21.html"}, {"source": "[email protected]", "tags": ["Issue Tracking", "Mailing List", "Vendor Advisory"], "url": "https://crbug.com/1250993"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BQRTR4SIUNIHLLPWTGYSDNQK7DYCRSB/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H2C4XOJVIILDXTOSMWJXHSQNEXFWSOD7/"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202208-25"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop_21.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Mailing List", "Vendor Advisory"], "url": "https://crbug.com/1250993"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BQRTR4SIUNIHLLPWTGYSDNQK7DYCRSB/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H2C4XOJVIILDXTOSMWJXHSQNEXFWSOD7/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202208-25"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "[email protected]", "type": "Primary"}]}