CVE-2019-8674
Advisory lineage Upstream: 0 Downstream: 9
Modified
Published: 18 Dec 2019, 17:33
Last modified:04 Aug 2024, 21:24
Vulnerability Summary
Overall Risk (default)
low
24/100 CVSS Score
6.1 MEDIUM
v3.1 (nvd)
EPSS Score
0.47% LOW
0% probability -0.16%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
18 Dec 2019, 17:33
Published
Vulnerability first disclosed
04 Aug 2024, 21:24
Last Modified
Vulnerability information updated
Description
A logic issue was addressed with improved state management. This issue is fixed in iOS 13, Safari 13. Processing maliciously crafted web content may lead to universal cross site scripting.
CVSS Metrics
- v3.1•MEDIUM•Score: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS Trends
Current EPSS score: 0.47%• Percentile: 64%
Techniques & Countermeasures
- CWE-79•Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected Systems
- Unknown•iOS
≥ unspecified, < iOS 13
- apple•iphone_os
< 13.0
- apple•safari
< 13 | ≥ unspecified, < Safari 13
- Unknown•WebKitGTK
< 2.26.4