CVE-2020-3838

HIGH

iPadOS < 13.3.1 - Privilege Escalation via Incorrect Default Permissions

Title source: manual
STIX 2.1

Description

The issue was addressed with improved permissions logic. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with system privileges.

References (7)

Core 7
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/HT210919
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/HT210918
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/HT210921
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/HT210920
Vendor Advisory x_refsource_confirm
https://support.apple.com/kb/HT212326
Vendor Advisory x_refsource_confirm
https://support.apple.com/kb/HT212327
Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2021/Apr/51

Scores

CVSS v3 7.8
EPSS 0.0149
EPSS Percentile 70.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-276
Status published
Products (6)
apple/ipados < 13.3.1
apple/iphone_os < 13.3.1
apple/mac_os_x 10.14.6 (14 CPE variants)
apple/mac_os_x < 10.14.6
apple/tvos < 13.3.1
apple/watchos < 6.1.2
Published Feb 27, 2020
Tracked Since Feb 18, 2026