CVE-2022-32550: Medium severity 1password vulnerability

Q: What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2022-32550.

Q: What is the severity of CVE-2022-32550?

The severity of CVE-2022-32550 is medium.

Q: What software versions are affected by CVE-2022-32550?

The following software versions are affected by CVE-2022-32550: 1Password for Android versions 7.0 to 7.9.3, 1Password for macOS versions 7.0 to 7.9.5, 1Password for iOS versions 7.0 to 7.9.6, 1Password for Windows versions 7.0 to 7.9.829, 1Password for Linux versions 8.0 to 8.7.1, 1Password for macOS versions 8.0 to 8.7.1, 1Password for Windows versions 8.0 to 8.7.1, 1Password for iOS versions 8.0 to 8.8.0-94, 1Password for Android versions 8.0 to 8.8.0-104, 1Password in the Browser versions up to 2.3.4, 1Password command-line versions 1.0.0 to 1.12.5, 1Password Connect versions up to 1.5.3, and 1Password SCIM Bridge versions up to 2.3.2.

Q: How can a malicious server exploit CVE-2022-32550?

A malicious server can exploit CVE-2022-32550 by convincing a 1Password app or integration that it is communicating with the 1Password service.

Q: Is there a fix available for CVE-2022-32550?

Yes, a fix for CVE-2022-32550 is available. It is recommended to update to the latest version of the affected software.

Published Jun 15, 2022

Updated

An issue was discovered in AgileBits 1Password, involving the method various 1Password apps and integrations used to create connections to the 1Password service. In specific circumstances, this issue allowed a malicious server to convince a 1Password app or integration it is communicating with the 1Password service.

Affected Software

15 affected components

1Password 1password Android>=7.0<7.9.3

1Password 1password Macos>=7.0<7.9.5

1Password 1password Iphone Os>=7.0<7.9.6

1Password 1password Windows>=7.0<7.9.829

1Password 1password Linux>=8.0<8.7.1

1Password 1password Macos>=8.0<8.7.1

1Password 1password Windows>=8.0<8.7.1

1Password 1password Iphone Os>=8.0<8.8.0-94

1Password 1password Android>=8.0<8.8.0-104

1Password 1password In The Browser<2.3.4

1Password command-line>=2.0.0<2.3.0

1Password Command Line Interface>=1.0.0<1.12.5

1Password connect<1.5.3

1Password SCIM Bridge<2.3.2

1Password command-line>=1.0.0<1.12.5

Event History

Jun 15, 2022

CVE Published

via MITRE·06:01 PM

Data Sourced

via MITRE·06:01 PM

Description

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2022-32550.

What is the severity of CVE-2022-32550?

The severity of CVE-2022-32550 is medium.

What software versions are affected by CVE-2022-32550?

The following software versions are affected by CVE-2022-32550: 1Password for Android versions 7.0 to 7.9.3, 1Password for macOS versions 7.0 to 7.9.5, 1Password for iOS versions 7.0 to 7.9.6, 1Password for Windows versions 7.0 to 7.9.829, 1Password for Linux versions 8.0 to 8.7.1, 1Password for macOS versions 8.0 to 8.7.1, 1Password for Windows versions 8.0 to 8.7.1, 1Password for iOS versions 8.0 to 8.8.0-94, 1Password for Android versions 8.0 to 8.8.0-104, 1Password in the Browser versions up to 2.3.4, 1Password command-line versions 1.0.0 to 1.12.5, 1Password Connect versions up to 1.5.3, and 1Password SCIM Bridge versions up to 2.3.2.

How can a malicious server exploit CVE-2022-32550?

A malicious server can exploit CVE-2022-32550 by convincing a 1Password app or integration that it is communicating with the 1Password service.

Is there a fix available for CVE-2022-32550?