CVE-2022-22671

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

An authentication issue was addressed with improved state management. This issue is fixed in iOS 15.4 and iPadOS 15.4. A person with physical access to an iOS device may be able to access photos from the lock screen.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
Apple	iOS and iPadOS	>= unspecified, < 15.4

References

https://support.apple.com/en-us/HT213182Vendor Advisory
https://support.apple.com/en-us/HT213182Vendor Advisory

Timeline

Published: Mar 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-226727.8A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.4 and iPadOS 15.4, Security Update 2022 CVE-2022-226737.5This issue was addressed with improved checks. This issue is fixed in iOS 15.5 and iPadOS 15.5. Processing a large input may lead to a denia CVE-2022-226745.5An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This iss CVE-2022-226757.8An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.CVE-2022-226765.5An event handler validation issue in the XPC Services API was addressed by removing the service. This issue is fixed in macOS Monterey 12.2.CVE-2022-226774.3A logic issue in the handling of concurrent media was addressed with improved state handling. This issue is fixed in macOS Monterey 12.4, iO CVE-2022-226794.9Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in support service management in Synology DiskS CVE-2022-22687.2The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without valida CVE-2022-226807.5Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager (DSM) before 7.0.1-42 CVE-2022-226817.5Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass s CVE-2022-226825.4Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Event Management in Synology Calendar CVE-2022-226839.8Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media Server before 1.8.1-