Lucene search

AppleCVE-2019-8632

HistoryDec 18, 2019 - 6:15 p.m.

CVE-2019-8632

2019-12-1818:15:30

CWE-319

apple

web.nvd.nist.gov

cve-2019-8632

security

data analytics

https

texture

ios

android

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.9

Confidence

High

EPSS

0.001

Percentile

46.8%

JSON

Some analytics data was sent using HTTP rather than HTTPS. This was addressed by no longer sending this analytics data. This issue is fixed in Texture 5.11.10 for iOS, Texture 4.22.0.4 for Android. An attacker in a privileged network position may be able to intercept analytics data.

Affected configurations

Nvd

Vulners

Node

appletextureRange<4.22.0.4android

appletextureRange<5.11.10ios

VendorProductVersionCPE
appletexture*cpe:2.3:a:apple:texture:*:*:*:*:*:android:*:*
appletexture*cpe:2.3:a:apple:texture:*:*:*:*:*:ios:*:*

Vendor	Product	Version	CPE
apple	texture	*	cpe:2.3:a:apple:texture::::::android::*
apple	texture	*	cpe:2.3:a:apple:texture::::::ios::*

CNA Affected

[
  {
    "product": "Texture-iOS",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "Texture 5.11.10 for iOS",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Texture-Android",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "Texture 4.22.0.4 for Android",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

support.apple.com/HT210110

support.apple.com/HT210111

www.info-sec.ca/advisories/Texture.html

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.9

Confidence

High

EPSS

0.001

Percentile

46.8%

JSON

Related for CVE-2019-8632