Paper/Archive/CVE-2022-42813

CVE-2022-42813

Apple macOS — A certificate validation issue existed in the handling of WKWebView.

CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 69.2.692 × 2013.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A certificate validation issue existed in the handling of WKWebView. This issue was addressed with improved validation. This issue is fixed in tvOS 16.1, iOS 16.1 and iPadOS 16, macOS Ventura 13, watchOS 9.1. Processing a maliciously crafted certificate may lead to arbitrary code execution.

Affected

ProductAffectedFixed inSource

macOSunspecified – < 1313CNA

tvOSunspecified – < 16.116.1CNA

watchOSunspecified – < 9.19.1CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsupport.apple.com/en-us/HT213488 refsupport.apple.com/en-us/HT213489 refsupport.apple.com/en-us/HT213492 refsupport.apple.com/en-us/HT213491