CVE-2019-8682

LOW

iPhone OS < 12.4 and watchOS < 5.3 - Unauthenticated In-App Purchase via Lock Screen

Title source: llm

Description

The issue was addressed with improved UI handling. This issue is fixed in iOS 12.4, watchOS 5.3. A user may inadvertently complete an in-app purchase while on the lock screen.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_misc

https://support.apple.com/HT210353

Vendor Advisory x_refsource_misc

https://support.apple.com/HT210346

Scores

CVSS v3 2.4

EPSS 0.0029

EPSS Percentile 20.5%

Attack Vector PHYSICAL

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Details

CWE

CWE-306

Status published

Products (2)

apple/iphone_os < 12.4

apple/watchos < 5.3

Published Dec 18, 2019

Tracked Since Feb 18, 2026