CVE-2018-4319 describes a cross-origin vulnerability in iframe elements affecting Apple iOS, watchOS, Safari, iTunes for Windows, and iCloud for Windows versions prior to their respective updates. This high-severity vulnerability (CVSS 8.1) could allow an unauthenticated attacker to achieve high confidentiality and integrity impacts with user interaction, due to improved tracking of security origins being absent. While the vulnerability has a high FAUCET Risk Score of 62/100, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, with only one mention and one article identified.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 7.7CPE matchmatch criteria | cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:* | ||
< 12.9CPE matchmatch criteria | cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:* | ||
< 12CPE matchmatch criteria | cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* | ||
< 12.0CPE matchmatch criteria | cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.