Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-rmn5-7m5w-bbem
Vulnerability ID VCID-rmn5-7m5w-bbem
Aliases CVE-2022-42975
GHSA-p8f7-22gq-m7j9
Summary socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-346 Origin Validation Error
CWE-863 Incorrect Authorization
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-284 Improper Access Control
System Score Found at
epss 0.00204 https://api.first.org/data/v1/epss?cve=CVE-2022-42975
epss 0.00204 https://api.first.org/data/v1/epss?cve=CVE-2022-42975
epss 0.00204 https://api.first.org/data/v1/epss?cve=CVE-2022-42975
cvssv3.1 7.5 https://github.com/phoenixframework/phoenix
generic_textual HIGH https://github.com/phoenixframework/phoenix
cvssv3.1 7.5 https://github.com/phoenixframework/phoenix/commit/6e7185b33a59e0b1d1c0b4223adf340a73e963ae
generic_textual HIGH https://github.com/phoenixframework/phoenix/commit/6e7185b33a59e0b1d1c0b4223adf340a73e963ae
ssvc Track https://github.com/phoenixframework/phoenix/commit/6e7185b33a59e0b1d1c0b4223adf340a73e963ae
cvssv3.1 7.5 https://hexdocs.pm/phoenix/1.6.14/changelog.html#1-6-14-2022-10-10
generic_textual HIGH https://hexdocs.pm/phoenix/1.6.14/changelog.html#1-6-14-2022-10-10
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2022-42975
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2022-42975
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-42975
https://github.com/phoenixframework/phoenix
https://hexdocs.pm/phoenix/1.6.14/changelog.html#1-6-14-2022-10-10
https://nvd.nist.gov/vuln/detail/CVE-2022-42975
6e7185b33a59e0b1d1c0b4223adf340a73e963ae https://github.com/phoenixframework/phoenix/commit/6e7185b33a59e0b1d1c0b4223adf340a73e963ae
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/phoenixframework/phoenix
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/phoenixframework/phoenix/commit/6e7185b33a59e0b1d1c0b4223adf340a73e963ae
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-10T03:03:26Z/ Found at https://github.com/phoenixframework/phoenix/commit/6e7185b33a59e0b1d1c0b4223adf340a73e963ae
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://hexdocs.pm/phoenix/1.6.14/changelog.html#1-6-14-2022-10-10
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-42975
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.426
EPSS Score 0.00204
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:37:50.258034+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2022/42xxx/CVE-2022-42975.json 38.6.0