Vulnerability CVE-2020-3873

Vulnerability Name:

CVE-2020-3873 (CCN-175325)

Assigned:

2019-12-18

Published:

2020-01-28

Updated:

2021-07-21

Summary:

This issue was addressed with improved setting propagation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. Turning off "Load remote content in messages” may not apply to all mail previews.

CVSS v3 Severity:

3.3 Low (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
2.9 Low (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
3.5 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

2.1 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-863

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2020-3873

Source: XF
Type: UNKNOWN
apple-ios-cve20203873-sec-bypass(175325)

Source: CCN
Type: Apple security document HT210918
About the security content of iOS 13.3.1 and iPadOS 13.3.1

Source: MISC
Type: Release Notes, Vendor Advisory
https://support.apple.com/HT210918

Vulnerable Configuration:

Configuration 1:

cpe:/o:apple:ipados:*:*:*:*:*:*:*:* (Version < 13.3.1)

OR cpe:/o:apple:iphone_os:*:*:*:*:*:*:*:* (Version < 13.3.1)

Configuration CCN 1:

cpe:/o:apple:ios:13.3:*:*:*:*:*:*:*

OR cpe:/o:apple:ipados:13.3:*:*:*:*:*:*:*

Denotes that component is vulnerable

BACK