VulnerabilityModified
CVE-2018-4117
It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.
MEDIUM 6.5EPSS 3.02%
Does this matter?
Lower severity and a low EPSS score (3.02%). Track it; it rarely justifies an emergency change on its own.
Description
An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. watchOS before 4.3 is affected. The issue involves the fetch API in the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.
- CVSS 3.0
- 6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- EPSS
- 3.02% probability · 87th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- apple/safari · apple/iphone os · apple/watchos · apple/icloud · apple/itunes · webkitgtk/webkitgtk\+ · canonical/ubuntu linux · debian/debian linux · redhat/enterprise linux desktop · redhat/enterprise linux server · redhat/enterprise linux workstation
- Source
- product-security@apple.com
References
- http://www.securityfocus.com/bid/104887Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040604Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:2282Third Party Advisory
- https://security.gentoo.org/glsa/201808-01Third Party Advisory
- https://security.gentoo.org/glsa/201808-04Third Party Advisory
- https://support.apple.com/HT208693Vendor Advisory
- https://support.apple.com/HT208694Vendor Advisory
- https://support.apple.com/HT208695Vendor Advisory
- https://support.apple.com/HT208696Vendor Advisory
- https://support.apple.com/HT208697Vendor Advisory
- https://usn.ubuntu.com/3635-1/Third Party Advisory
- https://www.debian.org/security/2018/dsa-4256Third Party Advisory
- http://www.securityfocus.com/bid/104887Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040604Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:2282Third Party Advisory
- https://security.gentoo.org/glsa/201808-01Third Party Advisory
- https://security.gentoo.org/glsa/201808-04Third Party Advisory
- https://support.apple.com/HT208693Vendor Advisory
- https://support.apple.com/HT208694Vendor Advisory
- https://support.apple.com/HT208695Vendor Advisory
- https://support.apple.com/HT208696Vendor Advisory
- https://support.apple.com/HT208697Vendor Advisory
- https://usn.ubuntu.com/3635-1/Third Party Advisory
- https://www.debian.org/security/2018/dsa-4256Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.