CVE-2019-8827

published 2020-10-27

CVE-2019-8827: The HTTP referrer header may be used to leak browsing history. The issue was resolved by downgrading all third party referrers to their origin. This issue is…

medium 4.3 CVSS 3.1

AV N AC L PR N UI R S U C L I N A N

The HTTP referrer header may be used to leak browsing history. The issue was resolved by downgrading all third party referrers to their origin. This issue is fixed in Safari 13.0.3, iTunes 12.10.2 for Windows, iCloud for Windows 10.9.2, tvOS 13.2, iOS 13.2 and iPadOS 13.2, iCloud for Windows 7.15. Visiting a maliciously crafted website may reveal the sites a user has visited.

Affected

18 ranges

Vendor	Product	Version range	Fixed in
apple	icloud	< 7.15	7.15
apple	icloud	>= 10.0 < 10.9.2	10.9.2
apple	icloud_for_windows	—	—
apple	icloud_for_windows	>= unspecified < 7.15	7.15
apple	icloud_for_windows	>= unspecified < 10.9	10.9
apple	ios_13.2_and_ipados	—	—
apple	ios_and_ipados	>= unspecified < 13.2	13.2
apple	ipados	< 13.2	13.2
apple	iphone_os	< 13.2	13.2
apple	itunes	< 12.10.2	12.10.2
apple	itunes_12.10.2_for_windows	—	—
apple	itunes_for_windows	>= unspecified < 12.10	12.10
apple	safari	< 13.0.3	13.0.3
apple	safari	—	—
apple	safari	>= unspecified < 13.0	13.0
apple	tvos	< 13.2	13.2
apple	tvos	—	—
apple	tvos	>= unspecified < 13.2	13.2