Apple iOS

CVE-2019-8515

MEDIUM 6.5

En bref

Source: NVD
EPSS: EPSS 1.23 % · centile 69 (2026-10-30)
État: PUBLISHED
Publiée: 2019-12-18 17:33 UTC
Mise à jour: 2024-08-04 21:17 UTC
Attribuée par: apple
Statut NVD: Modified

Rechercher sur…

Description

A cross-origin issue existed with the fetch API. This was addressed with improved input validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may disclose sensitive user information.

Faiblesses (CWE)

CWE-20 — Validation d'entrée incorrecte

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 4.3	AV:N/AC:M/Au:N/C:P/I:N/A:N	NVD · nvd@nist.gov (Primary)

Références européennes

ENISA EUVD · EUVD-2019-17905
GCVE · GCVE-0-2019-8515

Avis du CERT-FR

CERTFR-2019-AVI-129 — Multiples vulnérabilités dans les produits Apple · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:* < 7.11
cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:* < 12.9.4
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* < 12.1
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* < 12.2
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* < 12.2

Produits affectés

Produit	Versions
Apple · iOS	affected unspecified < iOS 12.2
Apple · tvOS	affected unspecified < tvOS 12.2
Apple · Safari	affected unspecified < Safari 12.1
Apple · iTunes for Windows	affected unspecified < iTunes 12.9.4 for Windows
Apple · iCloud for Windows	affected unspecified < iCloud for Windows 7.11

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

🟡 Apple iOS