Description
The issue was addressed with improved UI handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, Safari 13.0.5. A local user may unknowingly send a password unencrypted over the network.
References (2)
Core 2
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/HT210918
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/HT210922
Scores
CVSS v3
6.5
EPSS
0.0055
EPSS Percentile
41.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Details
CWE
CWE-319
CWE-522
Status
published
Products (3)
apple/ipados
< 13.3.1
apple/iphone_os
< 13.3.1
apple/safari
< 13.0.5
Published
Feb 27, 2020
Tracked Since
Feb 18, 2026