Apple iOS
En bref
- Source
- NVD
- EPSS
- EPSS 1.50 % · centile 74 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- apple
- Statut NVD
- Modified
Rechercher sur…
Description
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 14.0 and iPadOS 14.0, tvOS 14.0, watchOS 7.0, Safari 14.0, iCloud for Windows 11.4, iCloud for Windows 7.21. Processing maliciously crafted web content may lead to a cross site scripting attack.
Faiblesses (CWE)
- CWE-79 — Injection de code indirecte (XSS)
Références
- https://support.apple.com/HT211850
- https://support.apple.com/HT211844
- https://support.apple.com/HT211845
- https://support.apple.com/HT211843
- https://support.apple.com/HT211846
- https://support.apple.com/HT211847
- http://seclists.org/fulldisclosure/2020/Nov/18
- http://seclists.org/fulldisclosure/2020/Nov/19
- http://seclists.org/fulldisclosure/2020/Nov/20
- http://seclists.org/fulldisclosure/2020/Nov/22
- http://www.openwall.com/lists/oss-security/2020/11/23/3
- https://security.gentoo.org/glsa/202012-10
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.8 | AV:N/AC:M/Au:N/C:N/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2020-30731
- GCVE · GCVE-0-2020-9952
Avis du CERT-FR
- CERTFR-2020-AVI-616 — Multiples vulnérabilités dans Apple macOS · cert.ssi.gouv.fr
- CERTFR-2020-AVI-598 — Multiples vulnérabilités dans Apple Safari · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*< 7.21cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*≥ 11.0 < 11.4cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*< 14.0cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*< 14.0cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*< 14.0cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*< 14.0cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*< 7.0cpe:2.3:a:webkit:webkitgtk\+:*:*:*:*:*:*:*:*≤ 2.30.3
Produits affectés
| Produit | Versions |
|---|---|
| Apple · iOS | affected unspecified < iOS 14.0 and iPadOS 14.0 |
| Apple · tvOS | affected unspecified < tvOS 14.0 |
| Apple · watchOS | affected unspecified < watchOS 7.0 |
| Apple · Safari | affected unspecified < Safari 14.0 |
| Apple · iCloud for Windows | affected unspecified < iCloud for Windows 11.4 |
| Apple · iCloud for Windows (Legacy) | affected unspecified < iCloud for Windows 7.21 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |