7.8

CVE-2020-9862

A command injection issue existed in Web Inspector. This issue was addressed with improved escaping. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Copying a URL from Web Inspector may lead to command injection.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apple ≫ iCloud SwPlatform windows Version < 7.20
Apple ≫ iCloud SwPlatform windows Version >= 11.0 < 11.3
Apple ≫ iTunes SwPlatform windows Version < 12.10.8
Apple ≫ Safari Version < 13.1.2
Apple ≫ iPadOS Version < 13.6
Apple ≫ iPhone OS Version < 13.6
Apple ≫ tvOS Version < 13.4.8
Apple ≫ watchOS Version < 6.2.8
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.91% 0.78
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-116 Improper Encoding or Escaping of Output

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

https://support.apple.com/HT211288
Vendor Advisory
https://support.apple.com/HT211290
Vendor Advisory
https://support.apple.com/HT211291
Vendor Advisory
https://support.apple.com/HT211292
Vendor Advisory
https://support.apple.com/HT211293
Vendor Advisory
https://support.apple.com/HT211294
Vendor Advisory
https://support.apple.com/HT211295
Vendor Advisory