Lucene search

[email protected]CVE-2020-3867

HistoryFeb 27, 2020 - 9:15 p.m.

CVE-2020-3867

2020-02-2721:15:18

CWE-79

[email protected]

web.nvd.nist.gov

236

cve-2020-3867

ios 13.3.1

ipados 13.3.1

tvos 13.3.1

safari 13.0.5

itunes for windows 12.10.4

icloud for windows 11.0

icloud for windows 7.17

cross site scripting

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.2

Confidence

High

EPSS

0.002

Percentile

60.2%

JSON

A logic issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for Windows 7.17. Processing maliciously crafted web content may lead to universal cross site scripting.

Affected configurations

Vulners

NVD

Node

iphone_osRange<13.3.1

ipad_osRange<13.3.1

tvosRange<13.3.1

applesafariRange<13.0.5

itunes_for_windowsRange<12.10.4

itunes_for_windowsRange<11.0

itunes_for_windowsRange<7.17

VendorProductVersionCPE
appleiphone_os*cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
appleipad_os*cpe:2.3:o:apple:ipad_os:*:*:*:*:*:*:*:*
appletvos*cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
applesafari*cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
appleitunes*cpe:2.3:a:apple:itunes:*:*:*:*:*:*:*:*
appleicloud*cpe:2.3:a:apple:icloud:*:*:*:*:*:*:*:*
appleicloud*cpe:2.3:a:apple:icloud:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apple	iphone_os	*	cpe:2.3:o:apple:iphone_os::::::::
apple	ipad_os	*	cpe:2.3:o:apple:ipad_os::::::::
apple	tvos	*	cpe:2.3:o:apple:tvos::::::::
apple	safari	*	cpe:2.3:a:apple:safari::::::::
apple	itunes	*	cpe:2.3:a:apple:itunes::::::::
apple	icloud	*	cpe:2.3:a:apple:icloud::::::::
apple	icloud	*	cpe:2.3:a:apple:icloud::::::::

CNA Affected

[
  {
    "product": "iOS",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "iOS 13.3.1 and iPadOS 13.3.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "tvOS",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "tvOS 13.3.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Safari",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "Safari 13.0.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "iTunes for Windows",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "iTunes for Windows 12.10.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "iCloud for Windows",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "iCloud for Windows 11.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "iCloud for Windows (Legacy)",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "iCloud for Windows 7.17",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]