Lucene search

AppleCVE-2020-10010

HistoryDec 08, 2020 - 8:15 p.m.

CVE-2020-10010

2020-12-0820:15:13

CWE-22

apple

web.nvd.nist.gov

cve-2020-10010

path handling issue

macos

ios

ipados

tvos

watchos

privilege escalation

security update

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.4

Confidence

High

EPSS

Percentile

5.1%

JSON

A path handling issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, tvOS 14.2, watchOS 7.1. A local attacker may be able to elevate their privileges.

Affected configurations

Nvd

Vulners

Node

appleipadosRange<14.2

appleiphone_osRange<14.2

applemac_os_xRange<11.0.1

applemac_os_xRange10.14–10.14.6

applemac_os_xRange10.15–10.15.7

applemac_os_xMatch10.14.6-

applemac_os_xMatch10.14.6security_update_2019-001

applemac_os_xMatch10.14.6security_update_2019-002

applemac_os_xMatch10.14.6security_update_2019-004

applemac_os_xMatch10.14.6security_update_2019-005

applemac_os_xMatch10.14.6security_update_2019-006

applemac_os_xMatch10.14.6security_update_2019-007

applemac_os_xMatch10.14.6security_update_2020-001

applemac_os_xMatch10.14.6security_update_2020-002

applemac_os_xMatch10.14.6security_update_2020-003

applemac_os_xMatch10.14.6security_update_2020-004

applemac_os_xMatch10.14.6security_update_2020-005

applemac_os_xMatch10.14.6security_update_2020-006

applemac_os_xMatch10.15.7-

applemac_os_xMatch10.15.7security_update_2020

appletvosRange<14.2

applewatchosRange<7.1

VendorProductVersionCPE
appleipados*cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
appleiphone_os*cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
applemac_os_x*cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
applemac_os_x10.14.6cpe:2.3:o:apple:mac_os_x:10.14.6:-:*:*:*:*:*:*
applemac_os_x10.14.6cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:*
applemac_os_x10.14.6cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:*
applemac_os_x10.14.6cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:*
applemac_os_x10.14.6cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:*
applemac_os_x10.14.6cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:*
applemac_os_x10.14.6cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:*

Vendor	Product	Version	CPE
apple	ipados	*	cpe:2.3:o:apple:ipados::::::::
apple	iphone_os	*	cpe:2.3:o:apple:iphone_os::::::::
apple	mac_os_x	*	cpe:2.3:o:apple:mac_os_x::::::::
apple	mac_os_x	10.14.6	cpe:2.3:o:apple:mac_os_x:10.14.6:-::::::
apple	mac_os_x	10.14.6	cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001::::::
apple	mac_os_x	10.14.6	cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002::::::
apple	mac_os_x	10.14.6	cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004::::::
apple	mac_os_x	10.14.6	cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005::::::
apple	mac_os_x	10.14.6	cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006::::::
apple	mac_os_x	10.14.6	cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007::::::

Rows per page:

1-10 of 201

CNA Affected

[
  {
    "product": "watchOS",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "7.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "iOS and iPadOS",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "14.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "tvOS",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "14.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "macOS",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "11.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

seclists.org/fulldisclosure/2020/Dec/26

seclists.org/fulldisclosure/2020/Dec/32

support.apple.com/en-us/HT211928

support.apple.com/en-us/HT211929

support.apple.com/en-us/HT211930

support.apple.com/en-us/HT211931

support.apple.com/kb/HT212011

Social References

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.4

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2020-10010