CVE-2019-8632

Some analytics data was sent using HTTP rather than HTTPS. This was addressed by no longer sending this analytics data. This issue is fixed in Texture 5.11.10 for iOS, Texture 4.22.0.4 for Android. An attacker in a privileged network position may be able to intercept analytics data.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://support.apple.com/HT210110	Vendor Advisory
https://support.apple.com/HT210111	Vendor Advisory
https://www.info-sec.ca/advisories/Texture.html	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apple:texture::::::android::*
	cpe:2.3:a:apple:texture::::::ios::*

History

No history.

Information

Published : 2019-12-18 18:15

Updated : 2024-02-28 17:28

NVD link : CVE-2019-8632

Mitre link : CVE-2019-8632

CVE.ORG link : CVE-2019-8632

JSON object : View

Products Affected

apple

texture

CWE

CWE-319

Cleartext Transmission of Sensitive Information

{"id": "CVE-2019-8632", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2019-12-18T18:15:30.567", "references": [{"url": "https://support.apple.com/HT210110", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/HT210111", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://www.info-sec.ca/advisories/Texture.html", "tags": ["Third Party Advisory"], "source": "product-security@apple.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "Some analytics data was sent using HTTP rather than HTTPS. This was addressed by no longer sending this analytics data. This issue is fixed in Texture 5.11.10 for iOS, Texture 4.22.0.4 for Android. An attacker in a privileged network position may be able to intercept analytics data."}, {"lang": "es", "value": "Algunos datos anal\u00edticos fueron enviados utilizando HTTP en lugar de HTTPS. Esto fue abordado al dejar de enviar estos datos anal\u00edticos. Este problema es corregido en Texture versi\u00f3n 5.11.10 para iOS, Texture versi\u00f3n 4.22.0.4 para Android. Un atacante en una posici\u00f3n de red privilegiada puede ser capaz de interceptar datos anal\u00edticos."}], "lastModified": "2022-04-12T18:41:17.543", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apple:texture:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "1A174DBC-36E1-456B-A3BC-E3325E6DA618", "versionEndExcluding": "4.22.0.4"}, {"criteria": "cpe:2.3:a:apple:texture:*:*:*:*:*:ios:*:*", "vulnerable": true, "matchCriteriaId": "E7E71850-7929-4027-B348-6B3EEA27A588", "versionEndExcluding": "5.11.10"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}