CVE-2013-3948 — Improper Input Validation in Apple Iphone OS

CWE-20 — Improper Input Validation2 documents2 sources
Severity
4.3MEDIUMNVD
EPSS
0.3%
top 49.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Apple Iphone OS
Timeline
PublishedJun 5
Latest updateMay 17

Description

Apple iOS 6.1.3 does not follow redirects during determination of the hostname to display in an iOS Enterprise Deployment installation dialog, which makes it easier for remote attackers to trigger installation of arbitrary applications via a download-manifest itms-services:// URL that leverages an open redirect vulnerability within a trusted domain.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

▶NVDapple/iphone_os6.1.3

🔴Vulnerability Details

1
GHSA
GHSA-68mj-pqrr-wcxh: Apple iOS 6↗2022-05-17
▶
CVE-2013-3948 — Improper Input Validation in Apple | cvebase