CVE-2019-8658

Description

A logic issue was addressed with improved state management. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to universal cross site scripting.

CVSS Metrics

• v3.1•MEDIUM•Score: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 0.92%• Percentile: 76%

Techniques & Countermeasures

• CWE-79•Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected Systems

• apple•icloud

  < 7.13 | ≥ 10.0, < 10.6

• apple•icloud for windows

  ≥ unspecified, < iCloud for Windows 7.13

• apple•icloud for windows (microsoft store)

  ≥ unspecified, < iCloud for Windows 10.6

• Unknown•iOS

  ≥ unspecified, < iOS 12.4

• apple•iphone_os

  < 12.4

• apple•itunes

  < 12.9.6

• apple•itunes for windows

  ≥ unspecified, < iTunes for Windows 12.9.6

• apple•mac_os_x

  < 10.14.6

• apple•macos

  ≥ unspecified, < macOS Mojave 10.14.6

• apple•safari

  < 12.1.2 | ≥ unspecified, < Safari 12.1.2

• apple•tvos

  < 12.4 | ≥ unspecified, < tvOS 12.4

• apple•watchos

  < 5.3 | ≥ unspecified, < watchOS 5.3

References (8)

• https://support.apple.com/HT210353
• https://support.apple.com/HT210346
• https://support.apple.com/HT210348
• https://support.apple.com/HT210351
• https://support.apple.com/HT210355
• https://support.apple.com/HT210356
• https://support.apple.com/HT210357
• https://support.apple.com/HT210358