CVE-2019-8670 — Improper Input Validation in Apple Macos

CWE-20 — Improper Input Validation5 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.2%
top 55.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Apple MacosApple SafariApple MAC OS X
Timeline
PublishedDec 18
Latest updateMay 24

Description

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.6, Safari 12.1.2. Visiting a malicious website may lead to address bar spoofing.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶CVEListV5apple/macosunspecified — macOS Mojave 10.14.6
▶CVEListV5apple/safariunspecified — Safari 12.1.2
▶NVDapple/safari< 12.1.2
▶NVDapple/mac_os_x< 10.14.6

🔴Vulnerability Details

2
GHSA
GHSA-mv25-4x9x-fm3q: An inconsistent user interface issue was addressed with improved state management↗2022-05-24
▶
CVEList
CVE-2019-8670: An inconsistent user interface issue was addressed with improved state management↗2019-12-18
▶

📋Vendor Advisories

2
Apple
CVE-2019-8670: Safari 12.1.2↗2019-07-22
▶
Apple
CVE-2019-8670: macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra↗2019-07-22
▶
CVE-2019-8670 — Improper Input Validation in Apple | cvebase