PT-2022-13524 · Logitech · Logitech Options

Karan Bamal · Published 2022-05-03 · Updated 2022-05-11 · CVE-2022-0916

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Logitech Options (affected versions not specified)

Description An issue was discovered in the OAuth 2.0 implementation, where the state parameter was not properly validated. This leaves applications vulnerable to Cross-Site Request Forgery (CSRF) attacks during authentication and authorization operations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

CSRF

Weakness Enumeration

CWE-287

CWE-352

Related Identifiers

CVE-2022-0916

Affected Products

Logitech Options

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-0916 · Security Note
• https://support.logi.com/hc/en-us/articles/360025297893 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0916 · Vendor Advisory
• https://t.me/cvenotify/29993 · Telegram Post
• https://t.me/cibsecurity/41814 · Telegram Post