Lucene search

AppleCVE-2018-4397

HistoryApr 03, 2019 - 6:29 p.m.

CVE-2018-4397

2019-04-0318:29:13

CWE-20

apple

web.nvd.nist.gov

cwe-319

http

https

security

apple support

ios

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

3.9

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Analytics data was sent using HTTP rather than HTTPS. This was addressed by sending analytics data using HTTPS. This issue affected versions prior to Apple Support 2.4 for iOS.

Affected configurations

Nvd

Vulners

Node

appleapple_supportRange<2.4

AND

appleiphone_osMatch-

VendorProductVersionCPE
appleapple_support*cpe:2.3:a:apple:apple_support:*:*:*:*:*:*:*:*
appleiphone_os-cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apple	apple_support	*	cpe:2.3:a:apple:apple_support::::::::
apple	iphone_os	-	cpe:2.3:o:apple:iphone_os:-:::::::*

CNA Affected

[
  {
    "product": "Apple Support app",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Versions prior to: Apple Support for iOS 2.4"
      }
    ]
  }
]

References

support.apple.com/kb/HT209117

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

3.9

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Related for CVE-2018-4397