CVE-2019-8515

MEDIUM

iCloud < 7.11 - Cross-Origin Information Disclosure via Fetch API

Title source: llm
STIX 2.1

Description

A cross-origin issue existed with the fetch API. This was addressed with improved input validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may disclose sensitive user information.

References (5)

Core 5
Core References
Vendor Advisory x_refsource_misc
https://support.apple.com/HT209599
Vendor Advisory x_refsource_misc
https://support.apple.com/HT209601
Vendor Advisory x_refsource_misc
https://support.apple.com/HT209603
Vendor Advisory x_refsource_misc
https://support.apple.com/HT209604
Vendor Advisory x_refsource_misc
https://support.apple.com/HT209605

Scores

CVSS v3 6.5
EPSS 0.0123
EPSS Percentile 65.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Details

CWE
CWE-20
Status published
Products (5)
apple/icloud < 7.11
apple/iphone_os < 12.2
apple/itunes < 12.9.4
apple/safari < 12.1
apple/tvos < 12.2
Published Dec 18, 2019
Tracked Since Feb 18, 2026