CVE-2022-32550

Description

An issue was discovered in AgileBits 1Password, involving the method various 1Password apps and integrations used to create connections to the 1Password service. In specific circumstances, this issue allowed a malicious server to convince a 1Password app or integration it is communicating with the 1Password service.

Related CPE's

a1password1password_in_the_browser********

a1passwordconnect********

a1passwordscim_bridge********

a1passwordcommand-line********

a1passwordcommand-line********

a1password1password*****iphone_os**

a1password1password*****iphone_os**

a1password1password*****android**

a1password1password*****android**

a1password1password*****macos**

References

https://support.1password.com/kb/202206/

Vendor Advisory

CvssV3 impact

Could not find any metrics

CvssV2 impact

AccessComplexity

MEDIUM

ConfidentialityImpact

PARTIAL

AvailabilityImpact

NONE

IntegrityImpact

PARTIAL

BaseScore

5.800000190734863

VectorString

AV:N/AC:M/Au:N/C:P/I:P/A:N

Version

2.0

AccessVector

NETWORK

Authentication

NONE

Created by Yello
About Severity.io