Уязвимость универсального межсайтового скриптинга (UXSS) через некорректную обработку веб-контента в продуктах Apple
Описание
Обнаружена проблема универсального межсайтового скриптинга (XSS) при обработке вредоносного веб-контента из-за логической ошибки, связанной с управлением состоянием (state management).
Затронутые версии ПО
- iOS до версии 13.2
- iPadOS до версии 13.2
- tvOS до версии 13.2
- Safari до версии 13.0.3
- iTunes для Windows до версии 12.10.2
- iCloud для Windows до версии 11.0
Тип уязвимости
Универсальный межсайтовый скриптинг (UXSS)
Ссылки
- Third Party Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Third Party Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
6.1 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
Связанные уязвимости
A logic issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to universal cross site scripting.
A logic issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to universal cross site scripting.
A logic issue was addressed with improved state management. This issue ...
A logic issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to universal cross site scripting.
EPSS
6.1 Medium
CVSS3
4.3 Medium
CVSS2