Vulnerability · Published Oct 16, 2020 · Assigned by apple
CVE-2020-9952
High 7.1
In plain English
A high-severity security flaw in iCloud for Windows from Apple. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.1High
Exploit odds (30 days)1.5%top 25.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 14.0 and iPadOS 14.0, tvOS 14.0, watchOS 7.0, Safari 14.0, iCloud for Windows 11.4, iCloud for Windows 7.21. Processing maliciously crafted web content may lead to a cross site scripting attack.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | webkit2gtk | 2.28.3-r0 | ALPINE-CVE-2020-9952 |
| Debian:12 | webkit2gtk | 2.28.3-1 | DEBIAN-CVE-2020-9952 |
| Debian:13 | webkit2gtk | 2.28.3-1 | DEBIAN-CVE-2020-9952 |
| Debian:14 | webkit2gtk | 2.28.3-1 | DEBIAN-CVE-2020-9952 |
| Debian:12 | wpewebkit | 2.28.3-1 | DEBIAN-CVE-2020-9952 |
| Debian:13 | wpewebkit | 2.28.3-1 | DEBIAN-CVE-2020-9952 |
| Debian:14 | wpewebkit | 2.28.3-1 | DEBIAN-CVE-2020-9952 |
| Ubuntu:22.04:LTS | qtwebkit-opensource-src | no fix listed | UBUNTU-CVE-2020-9952 |
| Ubuntu:24.04:LTS | qtwebkit-opensource-src | no fix listed | UBUNTU-CVE-2020-9952 |
| Ubuntu:22.04:LTS | wpewebkit | no fix listed | UBUNTU-CVE-2020-9952 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apple | iOS | unspecified – before iOS 14.0 and iPadOS 14.0 |
| Apple | tvOS | unspecified – before tvOS 14.0 |
| Apple | watchOS | unspecified – before watchOS 7.0 |
| Apple | Safari | unspecified – before Safari 14.0 |
| Apple | iCloud for Windows | unspecified – before iCloud for Windows 11.4 |
| Apple | iCloud for Windows (Legacy) | unspecified – before iCloud for Windows 7.21 |
References
- https://support.apple.com/HT211850 x_refsource_MISC
- https://support.apple.com/HT211844 x_refsource_MISC
- https://support.apple.com/HT211845 x_refsource_MISC
- https://support.apple.com/HT211843 x_refsource_MISC
- https://support.apple.com/HT211846 x_refsource_MISC
- https://support.apple.com/HT211847 x_refsource_MISC
- 20201115 APPLE-SA-2020-11-13-5 Additional information for APPLE-SA-2020-09-16-3 Safari 14.0 mailing-list, x_refsource_FULLDISC
- 20201115 APPLE-SA-2020-11-13-4 Additional information for APPLE-SA-2020-09-16-2 tvOS 14.0 mailing-list, x_refsource_FULLDISC
- 20201115 APPLE-SA-2020-11-13-3 Additional information for APPLE-SA-2020-09-16-1 iOS 14.0 and iPadOS 14.0 mailing-list, x_refsource_FULLDISC
- 20201115 APPLE-SA-2020-11-13-6 Additional information for APPLE-SA-2020-09-16-4 watchOS 7.0 mailing-list, x_refsource_FULLDISC
- [oss-security] 20201123 WebKitGTK and WPE WebKit Security Advisory WSA-2020-0008 mailing-list, x_refsource_MLIST
- GLSA-202012-10 vendor-advisory, x_refsource_GENTOO