CVE-2022-32906: Medium severity apple music vulnerability

Q: What is CVE-2022-32906?

CVE-2022-32906 is a vulnerability in Apple Music for Android that allows an attacker in a privileged network position to intercept SSL/TLS connections.

Q: How was CVE-2022-32906 addressed?

CVE-2022-32906 was addressed by using HTTPS when sending information over the network.

Q: Which version of Apple Music for Android fixes CVE-2022-32906?

CVE-2022-32906 is fixed in Apple Music 3.9.10 for Android.

Q: What is the severity of CVE-2022-32906?

CVE-2022-32906 has a severity rating of 5.3 (medium).

Q: Where can I find more information about CVE-2022-32906?

You can find more information about CVE-2022-32906 on the Apple Support website: https://support.apple.com/en-us/HT213473

Published Jun 14, 2022

Updated

Apple Music on Android. This issue was addressed with improved state management.

Other sources

Apple Music on Android. This issue was addressed with using HTTPS when sending information over the network.

— Apple

This issue was addressed with using HTTPS when sending information over the network. This issue is fixed in Apple Music 3.9.10 for Android. A user in a privileged network position may intercept SSL/TLS connections.

— MITRE

Credit

David Coomber(Info), Martin Mwangi Kibuchi, hluwa

Affected Software

2 affected componentsFixes available

Apple Music Android<3.9.10

Apple Apple Music for Android<3.9.10

3.9.10

Event History

Jun 14, 2022

Data Sourced

via Apple·12:00 AM

DescriptionWeaknessAffected Software

Feb 27, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2022-32906?

CVE-2022-32906 is a vulnerability in Apple Music for Android that allows an attacker in a privileged network position to intercept SSL/TLS connections.

How was CVE-2022-32906 addressed?