CVE-2022-32846 Vulnerability Analysis & Exploit Details

CVE-2022-32846 Vulnerability Summary

CVE-2022-32846: A logic issue was addressed with improved state management. This issue is fixed in Apple Music 3.9.10 for Android. An app may be able to access user-sensitive data.

Exploit Prediction Scoring System (EPSS)

The EPSS score estimates the probability that this vulnerability will be exploited in the near future.

EPSS Score: 0.103% (probability of exploit)

EPSS Percentile: 44.03% (lower percentile = lower relative risk)
This vulnerability is less risky than approximately 55.97% of others.

CVE-2022-32846 References

External References

• https://support.apple.com/en-us/HT213473
• https://support.apple.com/en-us/HT213473

CWE Common Weakness Enumeration

CAPEC Common Attack Pattern Enumeration and Classification

• Session Credential Falsification through Forging CAPEC-196 An attacker creates a false but functional session credential in order to gain or usurp access to a service. Session credentials allow users to identify themselves to a service after an initial authentication without needing to resend the authentication information (usually a username and password) with every message. If an attacker is able to forge valid session credentials they may be able to bypass authentication or piggy-back off some other authenticated user's session. This attack differs from Reuse of Session IDs and Session Sidejacking attacks in that in the latter attacks an attacker uses a previous or existing credential without modification while, in a forging attack, the attacker must create their own credential, although it may be based on previously observed credentials.
• Exploitation of Trusted Identifiers CAPEC-21 An adversary guesses, obtains, or "rides" a trusted identifier (e.g. session ID, resource ID, cookie, etc.) to perform authorized actions under the guise of an authenticated user or service.
• Reusing Session IDs (aka Session Replay) CAPEC-60 This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.
• Session Fixation CAPEC-61 The attacker induces a client to establish a session with the target software using a session identifier provided by the attacker. Once the user successfully authenticates to the target software, the attacker uses the (now privileged) session identifier in their own transactions. This attack leverages the fact that the target software either relies on client-generated session identifiers or maintains the same session identifiers after privilege elevation.
• Cross Site Request Forgery CAPEC-62 An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.

Vulnerable Configurations

• cpe:2.3:a:apple:music:3.9.10:*:*:*:*:android:*:*
  cpe:2.3:a:apple:music:3.9.10:*:*:*:*:android:*:*

Other 5 Recently Published CVEs Vulnerabilities

• CVE-2025-43903 – NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries.
• CVE-2025-3796 – A vulnerability classified as critical has been found in PHPGurukul Men Salon Management System 1.0. This affects an unknown part of the file /admi...
• CVE-2025-32953 – z80pack is a mature emulator of multiple platforms with 8080 and Z80 CPU. In version 1.38 and prior, the `makefile-ubuntu.yml` workflow file uses `...
• CVE-2025-29058 – An issue in Qimou CMS v.3.34.0 allows a remote attacker to execute arbitrary code via the upgrade.php component.
• CVE-2024-53591 – An issue in the login page of Seclore v3.27.5.0 allows attackers to bypass authentication via a brute force attack.