CVE-2018-4293 : A cookie management issue was addressed with improved checks. This issue affecte

A cookie management issue was addressed with improved checks. This issue affected versions prior to iOS 11.4.1, macOS High Sierra 10.13.6, tvOS 11.4.1, watchOS 4.3.2, iTunes 12.8 for Windows, iCloud for Windows 7.6.

Published 2019-04-03 18:29:06

Updated 2019-04-05 14:45:22

Source Apple Inc.

View at NVD, CVE.org

Vulnerability category: Input validation

Products affected by CVE-2018-4293

Apple » Mac Os X
Versions before (<) 10.13.6
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Matching versions
Apple » Itunes
Versions before (<) 12.8
cpe:2.3:a:apple:itunes:*:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows » Version: N/A
Apple » Iphone Os
Versions before (<) 11.4.1
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Matching versions
Apple » Watchos
Versions before (<) 4.3.2
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Matching versions
Apple » Icloud
Versions before (<) 7.6
cpe:2.3:a:apple:icloud:*:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows » Version: N/A
Apple » Tvos
Versions before (<) 11.4.1
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2018-4293

EPSS FAQ

0.54%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 65 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-4293

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2018-4293

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-4293

https://support.apple.com/kb/HT208933

About the security content of iTunes 12.8 for Windows - Apple Support
Vendor Advisory

CVEs referencing this url
https://support.apple.com/kb/HT208935

About the security content of watchOS 4.3.2 - Apple Support
Vendor Advisory

CVEs referencing this url
https://support.apple.com/kb/HT208938

About the security content of iOS 11.4.1 - Apple Support
Vendor Advisory

CVEs referencing this url
https://support.apple.com/kb/HT208932

About the security content of iCloud for Windows 7.6 - Apple Support
Vendor Advisory

CVEs referencing this url
https://support.apple.com/kb/HT208937

About the security content of macOS High Sierra 10.13.6, Security Update 2018-004 Sierra, Security Update 2018-004 El Capitan - Apple Support
Vendor Advisory

CVEs referencing this url
https://support.apple.com/kb/HT208936

About the security content of tvOS 11.4.1 - Apple Support
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2018-4293

Products affected by CVE-2018-4293

Exploit prediction scoring system (EPSS) score for CVE-2018-4293

CVSS scores for CVE-2018-4293

CWE ids for CVE-2018-4293

References for CVE-2018-4293