High severityNVD Advisory· Published Oct 17, 2022· Updated May 10, 2025

CVE-2022-42975

Description

socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
phoenixHex	< 1.6.14	1.6.14

Affected products

Phoenix/Phoenixdescription
ghsa-coords
pkg:hex/phoenix
Range: < 1.6.14

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-p8f7-22gq-m7j9ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-42975ghsaADVISORY
github.com/phoenixframework/phoenix/commit/6e7185b33a59e0b1d1c0b4223adf340a73e963aeghsaWEB
hexdocs.pm/phoenix/1.6.14/changelog.htmlghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000