CVE-2016-4620

EPSS 0.26%
Veröffentlicht 18.09.2016 22:59:01
Zuletzt bearbeitet 12.04.2025 10:46:40
Quelle product-security@apple.com
CVE-Watchlists
Login
Unerledigt
Login

The Sandbox Profiles component in Apple iOS before 10 does not properly restrict access to directory metadata for SMS draft directories, which allows attackers to discover text-message recipients via a crafted app.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 8

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Apple ≫ iPhone OS Version <= 9.3.5

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.26%	0.487

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	3.3	1.8	1.4	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:P/I:N/A:N

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html

https://support.apple.com/HT207143

Vendor Advisory

http://lists.apple.com/archives/security-announce/2016/Sep/msg00002.html

Vendor Advisory

Mailing List

http://www.securityfocus.com/bid/92932

http://www.securitytracker.com/id/1036797

https://nvd.nist.gov/vuln/detail/CVE-2016-4620

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2016-4620

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2016-4620

EUVD