CVE-2022-43543 Other in KDDI +Message App for Android and for iOS, NTT DOCOMO +Message App for Android and for iOS, and SoftBank +Message App for Android and for iOS
Attackers can spoof URLs in messaging apps by exploiting improper Unicode handling, facilitating phishing attacks against users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-43543?
CVE-2022-43543 is a medium-severity vulnerability in KDDI +Message App for Android and for iOS, NTT DOCOMO +Message App for Android and for iOS, and SoftBank +Message App for Android and for iOS, published on 21 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
KDDI +Message App, NTT DOCOMO +Message App, and SoftBank +Message App contain a vulnerability caused by improper handling of Unicode control characters. +Message App displays text unprocessed, even when control characters are contained, and the text is shown based on Unicode control character's specifications. Therefore, a crafted text may display misleading web links. As a result, a spoofed URL may be displayed and phishing attacks may be conducted. Affected products and versions are as follows: KDDI +Message App for Android prior to version 3.9.2 and +Message App for iOS prior to version 3.9.4, NTT DOCOMO +Message App for Android prior to version 54.49.0500 and +Message App for iOS prior to version 3.9.4, and SoftBank +Message App for Android prior to version 12.9.5 and +Message App for iOS prior to version 3.9.4
Weakness: CWE-116
Which versions are affected by CVE-2022-43543?
It affects 3 products.
Products include Docomo \+ Message, Kddi \+ Message, Softbank \+ Message.
How do I fix CVE-2022-43543?
No fix has been published for CVE-2022-43543 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-43543 being exploited?
There is no known exploitation of CVE-2022-43543 in the wild and no public exploit code.
Sources
Also known as GHSA-jxxq-8qw2-56g4.