Lucene search

[email protected]CVE-2020-9976

HistoryOct 16, 2020 - 5:15 p.m.

CVE-2020-9976

2020-10-1617:15:18

[email protected]

web.nvd.nist.gov

cve-2020-9976

logic issue

ios 14.0

ipados 14.0

tvos 14.0

watchos 7.0

information leak

security vulnerability

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.9%

JSON

A logic issue was addressed with improved state management. This issue is fixed in iOS 14.0 and iPadOS 14.0, tvOS 14.0, watchOS 7.0. A malicious application may be able to leak sensitive user information.

Affected configurations

Vulners

NVD

Node

appleiphone_osRange<14.0

appleipad_osRange<14.0

appletvosRange<14.0

applewatchosRange<7.0

VendorProductVersionCPE
appleiphone_os*cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
appleipad_os*cpe:2.3:o:apple:ipad_os:*:*:*:*:*:*:*:*
appletvos*cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
applewatchos*cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apple	iphone_os	*	cpe:2.3:o:apple:iphone_os::::::::
apple	ipad_os	*	cpe:2.3:o:apple:ipad_os::::::::
apple	tvos	*	cpe:2.3:o:apple:tvos::::::::
apple	watchos	*	cpe:2.3:o:apple:watchos::::::::

CNA Affected

[
  {
    "product": "iOS",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "iOS 14.0 and iPadOS 14.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "tvOS",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "tvOS 14.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "watchOS",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "watchOS 7.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

seclists.org/fulldisclosure/2020/Nov/19

seclists.org/fulldisclosure/2020/Nov/20

seclists.org/fulldisclosure/2020/Nov/22

support.apple.com/HT211843

support.apple.com/HT211844

support.apple.com/HT211850

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.9%

JSON

Related for CVE-2020-9976

nvd1 cvelist1 prion1 threatpost1 apple6