CVE-2014-4480

EPSS 1.93%
Published 30.01.2015 11:59:12
Last modified 12.04.2025 10:46:40
Source product-security@apple.com
Teams watchlist Login
Open Login

Directory traversal vulnerability in afc in AppleFileConduit in Apple iOS before 8.1.3 and Apple TV before 7.0.3 allows attackers to access unintended filesystem locations by creating a symlink.

Affected products Warnungen 0 Metrics 2 CWE 1 References 9

Data is provided by the National Vulnerability Database (NVD)

Apple ≫ iPhone OS Version <= 8.1.2

Apple ≫ tvOS Version <= 7.0.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	1.93%	0.826

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	10	10	10	AV:N/AC:L/Au:N/C:C/I:C/A:C

CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html

Vendor Advisory

http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html

Vendor Advisory

http://support.apple.com/HT204245

Vendor Advisory

http://support.apple.com/HT204246

Vendor Advisory

http://www.securityfocus.com/bid/72334

http://www.securitytracker.com/id/1031652

https://nvd.nist.gov/vuln/detail/CVE-2014-4480

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2014-4480

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2014-4480

EUVD