Vulnerability Details : CVE-2016-4758
WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows remote attackers to obtain sensitive information via a crafted web site.
Vulnerability category: Information leak
Exploit prediction scoring system (EPSS) score for CVE-2016-4758
Probability of exploitation activity in the next 30 days: 0.45%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 72 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2016-4758
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:N |
8.6
|
2.9
|
NIST |
|
6.5
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2016-4758
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-4758
-
http://lists.apple.com/archives/security-announce/2016/Sep/msg00012.html
Apple - Lists.apple.comMailing List;Vendor Advisory
-
https://support.apple.com/HT207158
About the security content of iTunes 12.5.1 for Windows - Apple SupportVendor Advisory
-
https://support.apple.com/HT207143
About the security content of iOS 10 - Apple SupportVendor Advisory
-
http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html
Apple - Lists.apple.comMailing List;Vendor Advisory
-
https://support.apple.com/HT207157
About the security content of Safari 10 - Apple SupportVendor Advisory
-
http://www.securityfocus.com/bid/93066
Apple iTunes/Safari/iCloud/iOS Information Disclosure Vulnerability
-
http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html
Apple - Lists.apple.comMailing List;Vendor Advisory
-
http://www.securitytracker.com/id/1036854
Apple Safari Multiple Bugs Let Remote Users Obtain Potentially Sensitive Information, Spoof the Address Bar, Conduct Cross-Site Scripting Attacks, and Execute Arbitrary Code - SecurityTracker
-
http://mksben.l0.cm/2016/09/safari-uxss-showModalDialog.html
Products affected by CVE-2016-4758
- cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
- cpe:2.3:a:apple:itunes:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*