CVE-2020-9885

MEDIUM

iPadOS < 13.6 - Insufficient Verification of iMessage Tapbacks

Title source: llm
STIX 2.1

Description

An issue existed in the handling of iMessage tapbacks. The issue was resolved with additional verification. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. A user that is removed from an iMessage group could rejoin the group.

References (4)

Core 4
Core References
Vendor Advisory x_refsource_misc
https://support.apple.com/HT211289
Vendor Advisory x_refsource_misc
https://support.apple.com/HT211288
Vendor Advisory x_refsource_misc
https://support.apple.com/HT211290
Vendor Advisory x_refsource_misc
https://support.apple.com/HT211291

Scores

CVSS v3 5.5
EPSS 0.0044
EPSS Percentile 34.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Details

CWE
CWE-345
Status published
Products (5)
apple/ipados < 13.6
apple/iphone_os < 13.6
apple/mac_os_x < 10.15.6
apple/tvos < 13.4.8
apple/watchos < 6.2.8
Published Oct 16, 2020
Tracked Since Feb 18, 2026