{"id":"CVE-2022-42837","published":"2022-12-15T00:00:00Z","modified":"2025-04-21T17:00:52Z","title":"An issue existed in the parsing of URLs","vendor":"Apple","product":"macOS","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apple","product":"macOS","versions":[">= unspecified, < 13.1"]},{"vendor":"Apple","product":"macOS","versions":[">= unspecified, < 16.2"]},{"vendor":"Apple","product":"macOS","versions":[">= unspecified, < 15.7"]},{"vendor":"Apple","product":"watchOS","versions":[">= unspecified, < 9.2"]}],"description":{"text":"An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, watchOS 9.2. A remote user may be able to cause unexpected app termination or arbitrary code execution.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.02276,"percentile":0.83101,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2022-12-13","exploitedFirstSeen":"2022-12-13","ransomware":false,"evidence":[{"url":"https://support.apple.com/kb/HT213531","date":"2022-12-13"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://support.apple.com/kb/HT213535","tags":[]},{"url":"https://support.apple.com/en-us/HT213532","tags":[]},{"url":"https://support.apple.com/en-us/HT213530","tags":[]},{"url":"https://support.apple.com/en-us/HT213531","tags":[]},{"url":"https://support.apple.com/en-us/HT213536","tags":[]},{"url":"http://seclists.org/fulldisclosure/2022/Dec/20","tags":["mailing-list"]},{"url":"http://seclists.org/fulldisclosure/2022/Dec/21","tags":["mailing-list"]},{"url":"http://seclists.org/fulldisclosure/2022/Dec/23","tags":["mailing-list"]},{"url":"http://seclists.org/fulldisclosure/2022/Dec/27","tags":["mailing-list"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-45900","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-45900","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-12-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://support.apple.com/kb/HT213531","provenance":"source"},{"date":"2022-12-15","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-42837","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":58.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1419 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":16.62,"detail":"percentile 0.8310"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-apple-ios-macos-cwe-20"}}