CVE-2020-9775

An issue existed in the handling of tabs displaying picture in picture video. The issue was corrected with improved state handling. This issue is fixed in iOS 13.4 and iPadOS 13.4. A user's private browsing activity may be unexpectedly saved in Screen Time.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://support.apple.com/HT211102	Vendor Advisory
https://support.apple.com/kb/HT211100	Vendor Advisory
https://support.apple.com/HT211102	Vendor Advisory
https://support.apple.com/kb/HT211100	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:mac_os_x::::::::

History

21 Nov 2024, 05:41

Type	Values Removed	Values Added
References	~~() https://support.apple.com/HT211102 - Vendor Advisory~~	() https://support.apple.com/HT211102 - Vendor Advisory
References	~~() https://support.apple.com/kb/HT211100 - Vendor Advisory~~	() https://support.apple.com/kb/HT211100 - Vendor Advisory

Information

Published : 2020-04-01 18:15

Updated : 2024-11-21 05:41

NVD link : CVE-2020-9775

Mitre link : CVE-2020-9775

CVE.ORG link : CVE-2020-9775

JSON object : View

Products Affected

apple

iphone_os
mac_os_x
ipados

CWE

CWE-665

Improper Initialization

{"id": "CVE-2020-9775", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2020-04-01T18:15:17.803", "references": [{"url": "https://support.apple.com/HT211102", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/kb/HT211100", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/HT211102", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.apple.com/kb/HT211100", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-665"}]}], "descriptions": [{"lang": "en", "value": "An issue existed in the handling of tabs displaying picture in picture video. The issue was corrected with improved state handling. This issue is fixed in iOS 13.4 and iPadOS 13.4. A user's private browsing activity may be unexpectedly saved in Screen Time."}, {"lang": "es", "value": "Exist\u00eda un problema en el manejo de las pesta\u00f1as que mostraban la imagen en un video imagen. El problema se corrigi\u00f3 con un manejo de estado mejorado. Este problema es corregido en iOS versi\u00f3n 13.4 y iPadOS versi\u00f3n 13.4. La actividad de navegaci\u00f3n privada de un usuario puede guardarse inesperadamente en Screen Time."}], "lastModified": "2024-11-21T05:41:15.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1899DC84-D14F-4D7C-B5BD-1B64404BF4AC", "versionEndExcluding": "13.4"}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09DD8CD4-AF42-4A2B-8DF0-AED34E43FDD8", "versionEndExcluding": "13.4"}, {"criteria": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "71D69BB6-E786-47CE-B7DC-57274C9EFFC9", "versionEndExcluding": "10.15.4", "versionStartIncluding": "10.15"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}