CVE-2018-4311 is a high-severity vulnerability (CVSS 8.1) affecting Apple iOS, watchOS, Safari, iTunes for Windows, and iCloud for Windows versions prior to iOS 12, watchOS 5, Safari 12, iTunes 12.9, and iCloud for Windows 7.7 respectively. The vulnerability, categorized as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), was addressed by removing origin information. An attacker could exploit this remotely with low complexity, requiring user interaction, to achieve high confidentiality and integrity impacts, though without affecting availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion and media coverage, indicating awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 12CPE matchmatch criteria | cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* | ||
< 12.0CPE matchmatch criteria | cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* | ||
< 5.0CPE matchmatch criteria | cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* | ||
< 7.7CPE matchmatch criteria | cpe:2.3:a:apple:icloud:*:*:*:*:*:*:*:* | ||
< 12.9CPE matchmatch criteria | cpe:2.3:a:apple:itunes:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.