CVE-2020-9898

CRITICAL

iPadOS < 13.6 - Sandbox Restriction Bypass via Entitlement Misuse

Title source: llm
STIX 2.1

Description

This issue was addressed with improved entitlements. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A sandboxed process may be able to circumvent sandbox restrictions.

References (2)

Core 2
Core References
Vendor Advisory x_refsource_misc
https://support.apple.com/kb/HT211289
Vendor Advisory x_refsource_misc
https://support.apple.com/kb/HT211288

Scores

CVSS v3 9.8
EPSS 0.0134
EPSS Percentile 68.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

Status published
Products (3)
apple/ipados < 13.6
apple/iphone_os < 13.6
apple/mac_os_x 10.13.6 - 10.15.6
Published Oct 22, 2020
Tracked Since Feb 18, 2026