{"containers": {"cna": {"affected": [{"product": "iOS", "vendor": "Apple", "versions": [{"lessThan": "iOS 13.6 and iPadOS 13.6", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "tvOS", "vendor": "Apple", "versions": [{"lessThan": "tvOS 13.4.8", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "watchOS", "vendor": "Apple", "versions": [{"lessThan": "watchOS 6.2.8", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Safari", "vendor": "Apple", "versions": [{"lessThan": "Safari 13.1.2", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "iTunes for Windows", "vendor": "Apple", "versions": [{"lessThan": "iTunes 12.10.8 for Windows", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "iCloud for Windows", "vendor": "Apple", "versions": [{"lessThan": "iCloud for Windows 11.3", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "iCloud for Windows (Legacy)", "vendor": "Apple", "versions": [{"lessThan": "iCloud for Windows 7.20", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "A command injection issue existed in Web Inspector. This issue was addressed with improved escaping. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Copying a URL from Web Inspector may lead to command injection."}], "problemTypes": [{"descriptions": [{"description": "Copying a URL from Web Inspector may lead to command injection", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-10-16T16:32:39", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://support.apple.com/HT211288"}, {"tags": ["x_refsource_MISC"], "url": "https://support.apple.com/HT211290"}, {"tags": ["x_refsource_MISC"], "url": "https://support.apple.com/HT211291"}, {"tags": ["x_refsource_MISC"], "url": "https://support.apple.com/HT211292"}, {"tags": ["x_refsource_MISC"], "url": "https://support.apple.com/HT211293"}, {"tags": ["x_refsource_MISC"], "url": "https://support.apple.com/HT211294"}, {"tags": ["x_refsource_MISC"], "url": "https://support.apple.com/HT211295"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "product-security@apple.com", "ID": "CVE-2020-9862", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "iOS", "version": {"version_data": [{"version_affected": "<", "version_value": "iOS 13.6 and iPadOS 13.6"}]}}, {"product_name": "tvOS", "version": {"version_data": [{"version_affected": "<", "version_value": "tvOS 13.4.8"}]}}, {"product_name": "watchOS", "version": {"version_data": [{"version_affected": "<", "version_value": "watchOS 6.2.8"}]}}, {"product_name": "Safari", "version": {"version_data": [{"version_affected": "<", "version_value": "Safari 13.1.2"}]}}, {"product_name": "iTunes for Windows", "version": {"version_data": [{"version_affected": "<", "version_value": "iTunes 12.10.8 for Windows"}]}}, {"product_name": "iCloud for Windows", "version": {"version_data": [{"version_affected": "<", "version_value": "iCloud for Windows 11.3"}]}}, {"product_name": "iCloud for Windows (Legacy)", "version": {"version_data": [{"version_affected": "<", "version_value": "iCloud for Windows 7.20"}]}}]}, "vendor_name": "Apple"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A command injection issue existed in Web Inspector. This issue was addressed with improved escaping. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Copying a URL from Web Inspector may lead to command injection."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Copying a URL from Web Inspector may lead to command injection"}]}]}, "references": {"reference_data": [{"name": "https://support.apple.com/HT211288", "refsource": "MISC", "url": "https://support.apple.com/HT211288"}, {"name": "https://support.apple.com/HT211290", "refsource": "MISC", "url": "https://support.apple.com/HT211290"}, {"name": "https://support.apple.com/HT211291", "refsource": "MISC", "url": "https://support.apple.com/HT211291"}, {"name": "https://support.apple.com/HT211292", "refsource": "MISC", "url": "https://support.apple.com/HT211292"}, {"name": "https://support.apple.com/HT211293", "refsource": "MISC", "url": "https://support.apple.com/HT211293"}, {"name": "https://support.apple.com/HT211294", "refsource": "MISC", "url": "https://support.apple.com/HT211294"}, {"name": "https://support.apple.com/HT211295", "refsource": "MISC", "url": "https://support.apple.com/HT211295"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T10:43:05.449Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.apple.com/HT211288"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.apple.com/HT211290"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.apple.com/HT211291"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.apple.com/HT211292"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.apple.com/HT211293"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.apple.com/HT211294"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.apple.com/HT211295"}]}]}, "cveMetadata": {"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2020-9862", "datePublished": "2020-10-16T16:32:39", "dateReserved": "2020-03-02T00:00:00", "dateUpdated": "2024-08-04T10:43:05.449Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*", "matchCriteriaId": "5B3BB46F-F586-4A2B-91C6-4D3AA226B478", "versionEndExcluding": "7.20", "vulnerable": true}, {"criteria": "cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*", "matchCriteriaId": "354F932A-81A0-4C4F-91C0-8C76C72CC4E1", "versionEndExcluding": "11.3", "versionStartIncluding": "11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:*", "matchCriteriaId": "B626717E-0DED-4C76-B92D-D58AB27EED01", "versionEndExcluding": "12.10.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*", "matchCriteriaId": "FD59E88E-E189-4CF4-9799-CDD961BAE933", "versionEndExcluding": "13.1.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "matchCriteriaId": "87D68071-5235-4B50-90F0-B55B0C668840", "versionEndExcluding": "13.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "matchCriteriaId": "0639A5DE-4A59-4F10-A0E7-F6B933E44D47", "versionEndExcluding": "13.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*", "matchCriteriaId": "888463CA-9C67-46B2-B197-DDD3A668F980", "versionEndExcluding": "13.4.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*", "matchCriteriaId": "494FA012-A268-42FC-B023-2A10817B1096", "versionEndExcluding": "6.2.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A command injection issue existed in Web Inspector. This issue was addressed with improved escaping. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Copying a URL from Web Inspector may lead to command injection."}, {"lang": "es", "value": "Se present\u00f3 un problema de inyecci\u00f3n de comandos en Web Inspector.&#xa0;Este problema es abordado con un escape mejorado.&#xa0;Este problema es corregido en iOS versi\u00f3n 13.6 y iPadOS versi\u00f3n 13.6, tvOS versi\u00f3n 13.4.8, watchOS versi\u00f3n 6.2.8, Safari versi\u00f3n 13.1.2, iTunes versi\u00f3n 12.10.8 para Windows, iCloud para Windows versi\u00f3n 11.3, iCloud para Windows versi\u00f3n 7.20.&#xa0;Copiar una URL desde Web Inspector puede conllevar a una inyecci\u00f3n de comandos"}], "id": "CVE-2020-9862", "lastModified": "2023-01-09T16:41:59.350", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-10-16T17:15:15.433", "references": [{"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT211288"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT211290"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT211291"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT211292"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT211293"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT211294"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT211295"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}, {"lang": "en", "value": "CWE-77"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2020:4451", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "webkit2gtk3-0:2.28.4-1.el8", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2020-11-04T00:00:00Z"}], "bugzilla": {"description": "webkitgtk: Command injection in web inspector", "id": "1879532", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1879532"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-77", "details": ["A command injection issue existed in Web Inspector. This issue was addressed with improved escaping. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Copying a URL from Web Inspector may lead to command injection."], "name": "CVE-2020-9862", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "webkitgtk", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Will not fix", "package_name": "webkitgtk3", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Will not fix", "package_name": "webkitgtk4", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2020-07-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2020-9862\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-9862\nhttps://webkitgtk.org/security/WSA-2020-0007.html"], "threat_severity": "Moderate", "upstream_fix": "webkitgtk 2.28.4"}