CVE-2017-2371: apple iphone_os Improper Input Validation
CVSS: 6.5v3.1MediumModified
AliasesUBUNTU-CVE-2017-2371DEBIAN-CVE-2017-2371
Published 20-02-2017Last modified 05-08-2024
Vulnerability summary
CVE-2017-2371 is a medium (CVSS 6.5) Improper Input Validation vulnerability in apple iphone_os. EPSS estimates a 5.77% chance of exploitation in the next 30 days, higher than 92.9% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
6.5/10
010
Medium · v3.1 (NVD)EPSS score
5.77%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1exploit-database
Advisory lineage
Upstream 0 · Downstream 5 · Related 4Timeline
- 20-02-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "WebKit" component, which allows remote attackers to launch popups via a crafted web site.
CVSS metrics
4 scores · 3 sources · 2 versionsMedium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
5.77%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
0.00 pp
From 5.77% on 18-09-2026
18-09-202618-10-2026
EPSS score5.77%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundApple WebKit 10.0.2 - Cross-Origin or Sandboxed IFRAME Pop-up Blocker Bypass
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Ubuntu4 products
- qtwebkit-opensource-srcAll versions (No fix recorded)
- qtwebkit-sourceAll versions (No fix recorded)
- webkit2gtk< 2.14.5-0ubuntu0.16.04.1
- webkitgtkAll versions (No fix recorded)
Apple1 product
- iphone_os< 10.2.1
Debian1 product
- webkit2gtk< 2.14.4-1
3 vendors · 6 products
