SB2022101144 - Spoofing attack in Microsoft Windows CryptoAPI

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022101144

SB2022101144 - Spoofing attack in Microsoft Windows CryptoAPI

Published: October 11, 2022 Updated: January 27, 2023

Security Bulletin ID SB2022101144
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Spoofing attack (CVE-ID: CVE-2022-34689)

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/U:Green


The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of user-supplied data in the Windows CryptoAPI. A remote attacker can manipulate an existing public x.509 certificate, spoof page content and and perform actions such as authentication or code signing as the targeted certificate.


Remediation

Install update from vendor's website.

References