CVE-2020-10010

Published: Dec 8, 2020Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

A path handling issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, tvOS 14.2, watchOS 7.1. A local attacker may be able to elevate their privileges.

Affected (22)

Products: Apple: Ipados, Iphone Os, Mac Os X, Tvos, Watchos

5 products

Configuration A

22 vulnerable

Vulnerable Software	Affected Versions
Apple Ipados	Before 14.2
Apple Iphone Os	Before 14.2
Apple Mac Os X	Before 11.0.1
Apple Mac Os X	From 10.14 to 10.14.6
Apple Mac Os X	From 10.15 to 10.15.7
Apple Mac Os X	Version 10.14.6
Apple Mac Os X	Version 10.14.6 security_update_2019-001
Apple Mac Os X	Version 10.14.6 security_update_2019-002
Apple Mac Os X	Version 10.14.6 security_update_2019-004
Apple Mac Os X	Version 10.14.6 security_update_2019-005
Apple Mac Os X	Version 10.14.6 security_update_2019-006
Apple Mac Os X	Version 10.14.6 security_update_2019-007
Apple Mac Os X	Version 10.14.6 security_update_2020-001
Apple Mac Os X	Version 10.14.6 security_update_2020-002
Apple Mac Os X	Version 10.14.6 security_update_2020-003
Apple Mac Os X	Version 10.14.6 security_update_2020-004
Apple Mac Os X	Version 10.14.6 security_update_2020-005
Apple Mac Os X	Version 10.14.6 security_update_2020-006
Apple Mac Os X	Version 10.15.7
Apple Mac Os X	Version 10.15.7 security_update_2020
Apple Tvos	Before 14.2
Apple Watchos	Before 7.1

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (14)

http://seclists.org/fulldisclosure/2020/Dec/26

Source: product-security@apple.com

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2020/Dec/32

Source: product-security@apple.com

Mailing ListThird Party Advisory

https://support.apple.com/en-us/HT211928

Source: product-security@apple.com

Release NotesVendor Advisory

https://support.apple.com/en-us/HT211929

Source: product-security@apple.com

Release NotesVendor Advisory

https://support.apple.com/en-us/HT211930

Source: product-security@apple.com

Release NotesVendor Advisory

https://support.apple.com/en-us/HT211931

Source: product-security@apple.com

Release NotesVendor Advisory

https://support.apple.com/kb/HT212011

Source: product-security@apple.com

Vendor Advisory

http://seclists.org/fulldisclosure/2020/Dec/26

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2020/Dec/32

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://support.apple.com/en-us/HT211928

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://support.apple.com/en-us/HT211929

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://support.apple.com/en-us/HT211930

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://support.apple.com/en-us/HT211931

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://support.apple.com/kb/HT212011

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.