CVE-2020-9862: apple icloud Command Injection
Vulnerability summary
CVE-2020-9862 is a high (CVSS 7.8) Command Injection vulnerability in apple icloud. EPSS estimates a 1.92% chance of exploitation in the next 30 days, higher than 79.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 10 · Related 7Timeline
- 16-10-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A command injection issue existed in Web Inspector. This issue was addressed with improved escaping. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Copying a URL from Web Inspector may lead to command injection.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.92%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
+0.02 pp
From 1.91% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
- CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Affected systems
Apple11 products
- icloud< 7.20 | ≥ 11.0, < 11.3
- icloud for windows≥ unspecified, < iCloud for Windows 11.3
- icloud for windows (legacy)≥ unspecified, < iCloud for Windows 7.20
- ios≥ unspecified, < iOS 13.6 and iPadOS 13.6
- ipados< 13.6
Ubuntu5 products
- qtwebkit-opensource-srcAll versions (No fix recorded)
- qtwebkit-sourceAll versions (No fix recorded)
- webkit2gtkAll versions (No fix recorded) | < 2.28.4-0ubuntu0.18.04.1 | < 2.28.4-0ubuntu0.20.04.1
- webkitgtkAll versions (No fix recorded)
- wpewebkitAll versions (No fix recorded)
Debian2 products
- webkit2gtk< 2.28.4-1
- wpewebkit< 2.28.4-1
3 vendors · 18 products
