What is CVE-2022-0916?

CVE-2022-0916 is a high-severity vulnerability in Logitech Options, classified under Improper Authentication. CVSS score: 8.4/10. Published 2022-05-03.

How severe is CVE-2022-0916?

High severity. CVSS v3 base score is 8.4 out of 10.

CSRF in Logitech Options

CVE-2022-0916

An issue was discovered in Logitech Options. The OAuth 2.0 state parameter was not properly validated. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.

Vulnerability class: Broken Authentication

EPSS: 0.004 (35.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H.

Affected products

Logitech Options — versions 9.60.87

Weakness classification (CWE)

CWE-287 — Improper Authentication
CWE-352 — Cross-Site Request Forgery (CSRF)

References

cve-coordination@logitech.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2022-0916?: CVE-2022-0916 is a high-severity vulnerability in Logitech Options, classified under Improper Authentication. CVSS score: 8.4/10. Published 2022-05-03.
How severe is CVE-2022-0916?: High severity. CVSS v3 base score is 8.4 out of 10.