CVE-2022-22594
published 2022-03-18CVE-2022-22594: A cross-origin issue in the IndexDB API was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3…
PriorityP431medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
EPSS
0.81%
52.8th percentile
A cross-origin issue in the IndexDB API was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. A website may be able to track sensitive user information.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_15.3_and_ipados | — | — |
| apple | ios_and_ipados | >= unspecified < 15.3 | 15.3 |
| apple | ipados | < 15.3 | 15.3 |
| apple | iphone_os | < 15.3 | 15.3 |
| apple | macos | < 12.2 | 12.2 |
| apple | macos | >= unspecified < 12.2 | 12.2 |
| apple | macos_monterey | — | — |
| apple | safari | < 15.3 | 15.3 |
| apple | safari | — | — |
| apple | tvos | < 15.3 | 15.3 |
| apple | tvos | — | — |
| apple | tvos | >= unspecified < 15.3 | 15.3 |
| apple | watchos | < 8.4 | 8.4 |
| apple | watchos | — | — |
| apple | watchos | >= unspecified < 8.4 | 8.4 |
| debian | webkit2gtk | < webkit2gtk 2.34.4-1 (bookworm) | webkit2gtk 2.34.4-1 (bookworm) |
| debian | wpewebkit | < webkit2gtk 2.34.4-1 (bookworm) | webkit2gtk 2.34.4-1 (bookworm) |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2022-22594: iOS 15.3 and iPadOS 15.3
vendor_apple·2022-01-26·CVSS 6.5
CVE-2022-22594 [MEDIUM] CVE-2022-22594: iOS 15.3 and iPadOS 15.3
Apple Security Update: About the security content of iOS 15.3 and iPadOS 15.3
Product: iOS 15.3 and iPadOS
Version: 15.3
CVE: CVE-2022-22594
Component: WebKit Storage
Impact: A website may be able to track sensitive user information
Description: A cross-origin issue in the IndexDB API was addressed with improved input validation.
Apple
CVE-2022-22594: watchOS 8.4
vendor_apple·2022-01-26·CVSS 6.5
CVE-2022-22594 [MEDIUM] CVE-2022-22594: watchOS 8.4
Apple Security Update: About the security content of watchOS 8.4
Product: watchOS
Version: 8.4
CVE: CVE-2022-22594
Component: WebKit Storage
Impact: A website may be able to track sensitive user information
Description: A cross-origin issue in the IndexDB API was addressed with improved input validation.
Apple
CVE-2022-22594: tvOS 15.3
vendor_apple·2022-01-26·CVSS 6.5
CVE-2022-22594 [MEDIUM] CVE-2022-22594: tvOS 15.3
Apple Security Update: About the security content of tvOS 15.3
Product: tvOS
Version: 15.3
CVE: CVE-2022-22594
Component: WebKit Storage
Impact: A website may be able to track sensitive user information
Description: A cross-origin issue in the IndexDB API was addressed with improved input validation.
Apple
CVE-2022-22594: macOS Monterey 12.2
vendor_apple·2022-01-26·CVSS 6.5
CVE-2022-22594 [MEDIUM] CVE-2022-22594: macOS Monterey 12.2
Apple Security Update: About the security content of macOS Monterey 12.2
Product: macOS Monterey
Version: 12.2
CVE: CVE-2022-22594
Component: WebKit Storage
Impact: A website may be able to track sensitive user information
Description: A cross-origin issue in the IndexDB API was addressed with improved input validation.
Apple
CVE-2022-22594: Safari 15.3
vendor_apple·2022-01-26·CVSS 6.5
CVE-2022-22594 [MEDIUM] CVE-2022-22594: Safari 15.3
Apple Security Update: About the security content of Safari 15.3
Product: Safari
Version: 15.3
CVE: CVE-2022-22594
Component: WebKit Storage
Impact: A website may be able to track sensitive user information
Description: A cross-origin issue in the IndexDB API was addressed with improved input validation.
Red Hat
webkitgtk: A malicious website may exfiltrate data cross-origin
vendor_redhat·2022-01-21·CVSS 6.5
CVE-2022-22594 [MEDIUM] CWE-346 webkitgtk: A malicious website may exfiltrate data cross-origin
webkitgtk: A malicious website may exfiltrate data cross-origin
A cross-origin issue in the IndexDB API was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. A website may be able to track sensitive user information.
Package: webkitgtk (Red Hat Enterprise Linux 6) - Out of support scope
Package: webkitgtk3 (Red Hat Enterprise Linux 7) - Out of support scope
Package: webkit2gtk3 (Red Hat Enterprise Linux 9) - Not affected
Debian
CVE-2022-22594: webkit2gtk - A cross-origin issue in the IndexDB API was addressed with improved input valida...
vendor_debian·2022·CVSS 6.5
CVE-2022-22594 [MEDIUM] CVE-2022-22594: webkit2gtk - A cross-origin issue in the IndexDB API was addressed with improved input valida...
A cross-origin issue in the IndexDB API was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. A website may be able to track sensitive user information.
Scope: local
bookworm: resolved (fixed in 2.34.4-1)
bullseye: resolved (fixed in 2.34.4-1~deb11u1)
forky: resolved (fixed in 2.34.4-1)
sid: resolved (fixed in 2.34.4-1)
trixie: resolved (fixed in 2.34.4-1)
GHSA
GHSA-3xf9-qwxv-r3r4: A cross-origin issue in the IndexDB API was addressed with improved input validation
ghsa_unreviewed·2022-03-19
CVE-2022-22594 [MEDIUM] CWE-346 GHSA-3xf9-qwxv-r3r4: A cross-origin issue in the IndexDB API was addressed with improved input validation
A cross-origin issue in the IndexDB API was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. A website may be able to track sensitive user information.
OSV
CVE-2022-22594: A cross-origin issue in the IndexDB API was addressed with improved input validation
osv·2022-03-18·CVSS 6.5
CVE-2022-22594 [MEDIUM] CVE-2022-22594: A cross-origin issue in the IndexDB API was addressed with improved input validation
A cross-origin issue in the IndexDB API was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. A website may be able to track sensitive user information.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://support.apple.com/en-us/HT213053https://support.apple.com/en-us/HT213054https://support.apple.com/en-us/HT213057https://support.apple.com/en-us/HT213058https://support.apple.com/en-us/HT213059https://support.apple.com/en-us/HT213053https://support.apple.com/en-us/HT213054https://support.apple.com/en-us/HT213057https://support.apple.com/en-us/HT213058https://support.apple.com/en-us/HT213059
2022-03-18
Published