CVE-2016-4758 is a vulnerability in WebKit affecting Apple iOS before version 10, iTunes before 12.5.1 on Windows, and Safari before version 10. It allows remote attackers to obtain sensitive information by crafting a malicious website that bypasses restrictions on the location variable. This medium-severity vulnerability (CVSS 6.5) requires user interaction (UI:R) but has low attack complexity (AC:L), potentially leading to high confidentiality impact (C:H). While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), it has received some community discussion and media coverage, indicating awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 9.1.3CPE matchmatch criteria | cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* | ||
<= 9.3.5CPE matchmatch criteria | cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* | ||
<= 12.4.3CPE matchmatch criteria | cpe:2.3:a:apple:itunes:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.