CVE-2018-4319

HIGH

iCloud < 7.7, iTunes < 12.9, Safari < 12, iPhone OS < 12.0 - Cross-Origin Security Bypass via Iframe Origin Tracking

Title source: llm

Description

A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue affected versions prior to iOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.

References (5)

Core 5

Core References

Vendor Advisory x_refsource_misc

https://support.apple.com/kb/HT209141

Vendor Advisory x_refsource_misc

https://support.apple.com/kb/HT209140

Vendor Advisory x_refsource_misc

https://support.apple.com/kb/HT209106

Vendor Advisory x_refsource_misc

https://support.apple.com/kb/HT209108

Vendor Advisory x_refsource_misc

https://support.apple.com/kb/HT209109

Scores

CVSS v3 8.1

EPSS 0.0107

EPSS Percentile 60.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Details

CWE

CWE-346

Status published

Products (4)

apple/icloud < 7.7

apple/iphone_os < 12.0

apple/itunes < 12.9

apple/safari < 12

Published Apr 03, 2019

Tracked Since Feb 18, 2026