CVE-2020-9901
published 2020-10-22CVE-2020-9901: An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in iOS 13.6 and…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.34%
26.5th percentile
An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8. A local attacker may be able to elevate their privileges.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios | >= unspecified < iOS 13.6 and iPadOS 13.6 | iOS 13.6 and iPadOS 13.6 |
| apple | ios_13.6_and_ipados | — | — |
| apple | ipados | < 13.6 | 13.6 |
| apple | iphone_os | < 13.6 | 13.6 |
| apple | mac_os_x | < 10.15.6 | 10.15.6 |
| apple | macos | >= unspecified < macOS Catalina 10.15.6 | macOS Catalina 10.15.6 |
| apple | macos_catalina_10.15.6_security_update_2020-004_mojave_security_update_2020-004 | — | — |
| apple | tvos | < 13.4.8 | 13.4.8 |
| apple | tvos | — | — |
| apple | tvos | >= unspecified < tvOS 13.4.8 | tvOS 13.4.8 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9gqx-hpg2-mppr: An issue existed within the path validation logic for symlinks
ghsa_unreviewed·2022-05-24
CVE-2020-9901 [HIGH] CWE-59 GHSA-9gqx-hpg2-mppr: An issue existed within the path validation logic for symlinks
An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8. A local attacker may be able to elevate their privileges.
Apple
CVE-2020-9901: tvOS 13.4.8
vendor_apple·2020-07-15·CVSS 7.8
CVE-2020-9901 [HIGH] CVE-2020-9901: tvOS 13.4.8
Apple Security Update: About the security content of tvOS 13.4.8
Product: tvOS
Version: 13.4.8
CVE: CVE-2020-9901
Component: Security
Impact: An attacker may have been able to impersonate a trusted website using shared key material for an administrator added certificate
Description: A certificate validation issue existed when processing administrator added certificates. This issue was addressed with improved certificate validation.
Apple
CVE-2020-9901: macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
vendor_apple·2020-07-15·CVSS 7.8
CVE-2020-9901 [HIGH] CVE-2020-9901: macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
Apple Security Update: About the security content of macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
Product: macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
CVE: CVE-2020-9901
Component: Security
Impact: An application may be able to gain elevated privileges
Description: A logic issue was addressed with improved validation.
Apple
CVE-2020-9901: iOS 13.6 and iPadOS 13.6
vendor_apple·2020-07-15·CVSS 7.8
CVE-2020-9901 [HIGH] CVE-2020-9901: iOS 13.6 and iPadOS 13.6
Apple Security Update: About the security content of iOS 13.6 and iPadOS 13.6
Product: iOS 13.6 and iPadOS
Version: 13.6
CVE: CVE-2020-9901
Component: Security
Impact: An attacker may have been able to impersonate a trusted website using shared key material for an administrator added certificate
Description: A certificate validation issue existed when processing administrator added certificates. This issue was addressed with improved certificate validation.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-10-22
Published