CVE-2020-3867

MEDIUM

iCloud < 7.17 - Universal Cross-Site Scripting via Malicious Web Content

Title source: llm
STIX 2.1

Description

A logic issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for Windows 7.17. Processing maliciously crafted web content may lead to universal cross site scripting.

References (4)

Core 4
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/HT210947
Release Notes, Vendor Advisory x_refsource_misc
https://support.apple.com/HT210948
Mailing List, Patch, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00004.html
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202003-22

Scores

CVSS v3 6.1
EPSS 0.0036
EPSS Percentile 58.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (8)
apple/icloud < 7.17
apple/ipados < 13.3.1
apple/iphone_os < 13.3.1
apple/itunes < 12.10.4
apple/safari < 13.0.5
apple/tvos < 13.3.1
opensuse/leap 15.1
webkitgtk/webkitgtk < 2.26.4
Published Feb 27, 2020
Tracked Since Feb 18, 2026