CVE-2021-1748

Published: Apr 2, 2021Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A validation issue was addressed with improved input sanitization. This issue is fixed in tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted URL may lead to arbitrary javascript code execution.

Affected (4)

Products: Apple: Ipados, Iphone Os, Tvos, Watchos

4 products

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Apple Ipados	Before 14.4
Apple Iphone Os	Before 14.4
Apple Tvos	Before 14.4
Apple Watchos	Before 7.3

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (6)

https://support.apple.com/en-us/HT212146

Source: product-security@apple.com

Release NotesVendor Advisory

https://support.apple.com/en-us/HT212148

Source: product-security@apple.com

Release NotesVendor Advisory

https://support.apple.com/en-us/HT212149

Source: product-security@apple.com

Release NotesVendor Advisory

https://support.apple.com/en-us/HT212146

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://support.apple.com/en-us/HT212148

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://support.apple.com/en-us/HT212149

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.