CVE-2019-8827

MEDIUM

iCloud < 7.15 - Browsing History Leak via HTTP Referrer Header

Title source: llm
STIX 2.1

Description

The HTTP referrer header may be used to leak browsing history. The issue was resolved by downgrading all third party referrers to their origin. This issue is fixed in Safari 13.0.3, iTunes 12.10.2 for Windows, iCloud for Windows 10.9.2, tvOS 13.2, iOS 13.2 and iPadOS 13.2, iCloud for Windows 7.15. Visiting a maliciously crafted website may reveal the sites a user has visited.

References (6)

Core 6
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT210721
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT210723
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT210725
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT210726
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT210728
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT210947

Scores

CVSS v3 4.3
EPSS 0.0104
EPSS Percentile 60.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Details

Status published
Products (6)
apple/icloud < 7.15
apple/ipados < 13.2
apple/iphone_os < 13.2
apple/itunes < 12.10.2
apple/safari < 13.0.3
apple/tvos < 13.2
Published Oct 27, 2020
Tracked Since Feb 18, 2026