CVE-2020-10003

HIGH

iPadOS < 14.2 - Privilege Escalation via Symlink Path Validation Flaw

Title source: llm
STIX 2.1

Description

An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, tvOS 14.2, watchOS 7.1. A local attacker may be able to elevate their privileges.

References (5)

Core 5
Core References
Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT211931
Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT211928
Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT211929
Vendor Advisory x_refsource_misc
https://support.apple.com/en-us/HT211930
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2020/Dec/32

Scores

CVSS v3 7.8
EPSS 0.0039
EPSS Percentile 30.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-59
Status published
Products (5)
apple/ipados < 14.2
apple/iphone_os < 14.2
apple/mac_os_x < 11.0.1
apple/tvos < 14.2
apple/watchos < 7.1
Published Dec 08, 2020
Tracked Since Feb 18, 2026