What’s Vulnerable › Vulnerabilities

CVE-2022-42975

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-10-17 · updated 2026-06-17
• Weakness: CWE-863

Description

socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token.

Affected products

• phoenixframework phoenix: before 1.6.14 — fixed in 1.6.14

How to fix

Upgrade to a fixed version: phoenixframework phoenix 1.6.14. Check the vendor advisory for mitigations.

References

• https://github.com/phoenixframework/phoenix/commit/6e7185b33a59e0b1d1c0b4223adf340a73e963ae
• https://github.com/phoenixframework/phoenix/commit/6e7185b33a59e0b1d1c0b4223adf340a73e963ae

Get alerted when CVE-2022-42975 or the next vulnerability affects your stack