Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-43543

KDDI +Message App, NTT DOCOMO +Message App, and SoftBank +Message App contain a vulnerability caused by improper handling of Unicode control characters. +Message App displays text unprocessed, even when control characters are contained, and the text is shown based on Unicode control character's specifications. Therefore, a crafted text may display misleading web links. As a result, a spoofed URL may be displayed and phishing attacks may be conducted. Affected products and versions are as follows: KDDI +Message App for Android prior to version 3.9.2 and +Message App for iOS prior to version 3.9.4, NTT DOCOMO +Message App for Android prior to version 54.49.0500 and +Message App for iOS prior to version 3.9.4, and SoftBank +Message App for Android prior to version 12.9.5 and +Message App for iOS prior to version 3.9.4

Published

2022-12-21T09:15:07.907

Last Modified

2025-04-16T18:15:57.533

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.4 (MEDIUM)

Weaknesses
  • Type: Primary
    NVD-CWE-Other
  • Type: Secondary
    CWE-116
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application docomo \+_message < 3.9.4 Yes
Application docomo \+_message < 54.49.0500 Yes
Application kddi \+_message < 3.9.2 Yes
Application kddi \+_message < 3.9.4 Yes
Application softbank \+_message < 3.9.4 Yes
Application softbank \+_message < 12.9.5 Yes
References