CVE-2020-9977 — Improper Input Validation in Apple IOS AND Ipados

CWE-20 — Improper Input Validation3 documents3 sources
Severity
5.5MEDIUMNVD
EPSS
0.4%
top 41.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Apple IOS AND IpadosApple MacosApple Ipados+2 more
Timeline
PublishedDec 8
Latest updateMay 24

Description

A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.0 and iPadOS 14.0. A malicious application may be able to determine a user's open tabs in Safari.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5apple/macosunspecified — 11.0
▶NVDapple/ipados< 14.2
▶NVDapple/mac_os_x< 11.0.1
▶CVEListV5apple/ios_and_ipadosunspecified — 14.0
▶NVDapple/iphone_os< 14.2

🔴Vulnerability Details

2
GHSA
GHSA-hj4j-qvhm-2c74: A validation issue existed in the entitlement verification↗2022-05-24
▶
CVEList
CVE-2020-9977: A validation issue existed in the entitlement verification↗2020-12-08
▶
CVE-2020-9977 — Improper Input Validation in Apple | cvebase