What is the CVSS score of CVE-2022-45195?

CVE-2022-45195 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Is there a public PoC exploit available for CVE-2022-45195?

Yes, a public proof-of-concept exploit is available for CVE-2022-45195. Prioritise patching immediately. EPSS: 0.6%.

Is there a patch available for CVE-2022-45195?

Yes, a patch is available for CVE-2022-45195. Update the affected software to the latest version immediately.

Simplex Chat CVE-2022-45195

MEDIUM

Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

2022-11-12 cve@mitre.org

Information Disclosure Microsoft Simplex Chat Simplexmq

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Nov 12, 2022 - 19:15 nvd

MEDIUM 5.3

DescriptionNVD

SimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, does not apply a key derivation function to intended data, which can interfere with forward secrecy and can have other impacts if there is a compromise of a single private key. This occurs in the X3DH key exchange for the double ratchet protocol.

AnalysisAI

SimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, does not apply a key derivation function to intended data, which can interfere with forward secrecy and can have other impacts if there is. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-327. SimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, does not apply a key derivation function to intended data, which can interfere with forward secrecy and can have other impacts if there is a compromise of a single private key. This occurs in the X3DH key exchange for the double ratchet protocol. Affected products include: Simplex Simplex Chat, Simplex Simplexmq. Version information: before 3.4.0.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.