CVE-2025-31205

MEDIUM

Apple Safari < 18.5 - CSRF

Title source: rule

Description

The issue was addressed with improved checks. This issue is fixed in watchOS 11.5, tvOS 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. A malicious website may exfiltrate data cross-origin.

References (12)

[Release Notes, Vendor Advisory] https://support.apple.com/en-us/122404

[Release Notes, Vendor Advisory] https://support.apple.com/en-us/122716

[Release Notes, Vendor Advisory] https://support.apple.com/en-us/122719

[Release Notes, Vendor Advisory] https://support.apple.com/en-us/122720

[Release Notes, Vendor Advisory] https://support.apple.com/en-us/122721

[Release Notes, Vendor Advisory] https://support.apple.com/en-us/122722

[Mailing List] https://lists.debian.org/debian-lts-announce/2025/06/msg00016.html

[Mailing List] http://seclists.org/fulldisclosure/2025/May/10

[Mailing List] http://seclists.org/fulldisclosure/2025/May/12

[Mailing List] http://seclists.org/fulldisclosure/2025/May/13

[Mailing List] http://seclists.org/fulldisclosure/2025/May/5

[Mailing List] http://seclists.org/fulldisclosure/2025/May/7

Scores

CVSS v3 6.5

EPSS 0.0017

EPSS Percentile 37.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Classification

CWE

CWE-352

Status published

Affected Products (7)

apple/safari < 18.5

apple/ipados < 18.5

apple/iphone_os < 18.5

apple/macos < 15.5

apple/tvos < 18.5

apple/visionos < 2.5

apple/watchos < 11.5

Timeline

Published May 12, 2025

Tracked Since Feb 18, 2026