CVE-2020-9885 — Insufficient Verification of Data Authenticity in Apple Macos

CWE-345 — Insufficient Verification of Data Authenticity6 documents4 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 70.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Apple IOSApple MacosApple Tvos+4 more
Timeline
PublishedOct 16
Latest updateMay 24

Description

An issue existed in the handling of iMessage tapbacks. The issue was resolved with additional verification. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. A user that is removed from an iMessage group could rejoin the group.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages9 packages

▶CVEListV5apple/tvosunspecified — tvOS 13.4.8
▶NVDapple/tvos< 13.4.8
▶CVEListV5apple/macosunspecified — macOS Catalina 10.15.6
▶NVDapple/ipados< 13.6
▶CVEListV5apple/watchosunspecified — watchOS 6.2.8

🔴Vulnerability Details

2
GHSA
GHSA-mwr9-mrq7-g9xf: An issue existed in the handling of iMessage tapbacks↗2022-05-24
▶
CVEList
CVE-2020-9885: An issue existed in the handling of iMessage tapbacks↗2020-10-16
▶

📋Vendor Advisories

3
Apple
CVE-2020-9885: iOS 13.6 and iPadOS 13.6↗2020-07-15
▶
Apple
CVE-2020-9885: watchOS 6.2.8↗2020-07-15
▶
Apple
CVE-2020-9885: macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra↗2020-07-15
▶
CVE-2020-9885 — Apple Macos vulnerability | cvebase