VulnerabilityModified
CVE-2020-3864
A logic issue was addressed with improved validation.
HIGH 7.8EPSS 0.40%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.40%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7.17, iTunes 12.10.4 for Windows, iCloud for Windows 10.9.2, tvOS 13.3.1, Safari 13.0.5, iOS 13.3.1 and iPadOS 13.3.1. A DOM object context may not have had a unique security origin.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.40% probability · 34th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-346
- Affected
- apple/icloud · apple/itunes · apple/safari · apple/ipados · apple/iphone os · apple/tvos · redhat/enterprise linux desktop · redhat/enterprise linux server · redhat/enterprise linux workstation
- Source
- product-security@apple.com
References
- https://support.apple.com/en-us/HT210918Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT210920Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT210922Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT210923Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT210947Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT210948Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT210918Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT210920Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT210922Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT210923Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT210947Release Notes, Vendor Advisory
- https://support.apple.com/en-us/HT210948Release Notes, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.