CVE-2022-1130
published 2022-07-23CVE-2022-1130: Insufficient validation of trust input in WebOTP in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to send arbitrary intents from…
PriorityP340high8.1CVSS 3.1
AVNACLPRNUIRSUCNIHAH
EPSS
0.81%
53.1th percentile
Insufficient validation of trust input in WebOTP in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to send arbitrary intents from any app via a malicious app.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chromium | chromium | >= 0 < 100.0.4896.60-1~deb11u1 | 100.0.4896.60-1~deb11u1 |
| chromium | chromium | >= 0 < 100.0.4896.60-1 | 100.0.4896.60-1 |
| chromium | chromium | >= 0 < 100.0.4896.60-1 | 100.0.4896.60-1 |
| chromium | chromium | >= 0 < 100.0.4896.60-1 | 100.0.4896.60-1 |
| debian | chromium | < chromium 100.0.4896.60-1 (bookworm) | chromium 100.0.4896.60-1 (bookworm) |
| chrome | < 100.0.4896.60 | 100.0.4896.60 | |
| chrome | >= unspecified < 100.0.4896.60 | 100.0.4896.60 | |
| chrome_chrome | — | — | |
| msrc | microsoft_edge | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
osv8.1HIGH
cisa7.8HIGH
vendor_debian8.1HIGH
vendor_msrc8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9wq5-2p9c-q5w5: Insufficient validation of trust input in WebOTP in Google Chrome on Android prior to 100
ghsa_unreviewed·2022-07-24
CVE-2022-1130 [HIGH] CWE-476 GHSA-9wq5-2p9c-q5w5: Insufficient validation of trust input in WebOTP in Google Chrome on Android prior to 100
Insufficient validation of trust input in WebOTP in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to send arbitrary intents from any app via a malicious app.
OSV
CVE-2022-1130: Insufficient validation of trust input in WebOTP in Google Chrome on Android prior to 100
osv·2022-07-23·CVSS 8.1
CVE-2022-1130 [HIGH] CVE-2022-1130: Insufficient validation of trust input in WebOTP in Google Chrome on Android prior to 100
Insufficient validation of trust input in WebOTP in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to send arbitrary intents from any app via a malicious app.
CISA
Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability
cisa·2022-05-23·CVSS 7.8
CVE-2019-1130 [HIGH] CWE-59 Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability
Vulnerability: Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability
Affected: Microsoft Windows
A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2019-1130
Remediation Due Date: 2022-06-13
Microsoft
Chromium: CVE-2022-1130 Insufficient validation of untrusted input in WebOTP
vendor_msrc·2022-04-12·CVSS 8.1
CVE-2022-1130 [HIGH] Chromium: CVE-2022-1130 Insufficient validation of untrusted input in WebOTP
Chromium: CVE-2022-1130 Insufficient validation of untrusted input in WebOTP
Description: This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
FAQ: What is the version information for this release?
Microsoft Edge Version
Date Released
Based on Chromium Version
100.0.1185.29
4/1/2022
100.0.4896.60
FAQ: Why is this Chrome CVE included in the Security Update Guide?
The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable.
How can I see the vers
Chrome
Stable Channel Update for Desktop: CVE-2022-1129
vendor_chrome·2022-03-29·CVSS 6.5
CVE-2022-1129 [HIGH] Stable Channel Update for Desktop: CVE-2022-1129
Stable Channel Update for Desktop
CVE-2022-1129: Inappropriate implementation in Full Screen Mode. Reported by Irvan Kurniawan (sourc7) on 2022-02-24 [$1000][ 1142269 ] High CVE-2022-1130: Insufficient validation of untrusted input in WebOTP
Reported by Sergey Toshin of Oversecurity Inc
Severity: high
CISA
Apple OS X Authentication Bypass Vulnerability
cisa·2022-02-10·CVSS 7.8
CVE-2015-1130 [HIGH] CWE-254 Apple OS X Authentication Bypass Vulnerability
Vulnerability: Apple OS X Authentication Bypass Vulnerability
Affected: Apple OS X
The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2015-1130
Remediation Due Date: 2022-08-10
Debian
CVE-2022-1130: chromium - Insufficient validation of trust input in WebOTP in Google Chrome on Android pri...
vendor_debian·2022·CVSS 8.1
CVE-2022-1130 [HIGH] CVE-2022-1130: chromium - Insufficient validation of trust input in WebOTP in Google Chrome on Android pri...
Insufficient validation of trust input in WebOTP in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to send arbitrary intents from any app via a malicious app.
Scope: local
bookworm: resolved (fixed in 100.0.4896.60-1)
bullseye: resolved (fixed in 100.0.4896.60-1~deb11u1)
forky: resolved (fixed in 100.0.4896.60-1)
sid: resolved (fixed in 100.0.4896.60-1)
trixie: resolved (fixed in 100.0.4896.60-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.htmlhttps://crbug.com/1142269https://security.gentoo.org/glsa/202208-25https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.htmlhttps://crbug.com/1142269https://security.gentoo.org/glsa/202208-25
2022-07-23
Published