Apple Safari up to 11.1.1 State Management input validation
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 6.3 | $0-$5k | 0.00 |
Summary
A vulnerability was found in Apple Safari up to 11.1.1. It has been classified as critical. This vulnerability affects unknown code of the component State Management. This manipulation causes input validation. The identification of this vulnerability is CVE-2018-4362. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.
Details
A vulnerability classified as critical was found in Apple Safari up to 11.1.1 (Web Browser). Affected by this vulnerability is an unknown code block of the component State Management. The manipulation with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process the data safely and
correctly. As an impact it is known to affect integrity. The summary by CVE is:
An inconsistent user interface issue was addressed with improved state management. This issue affected versions prior to Safari 11.1.2, iOS 12.
The bug was discovered 09/17/2018. The weakness was shared 04/03/2019. This vulnerability is known as CVE-2018-4362 since 01/02/2018. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/25/2023).
The vulnerability was handled as a non-public zero-day exploit for at least 198 days. During that time the estimated underground price was around $5k-$25k.
Upgrading to version 11.1.2 eliminates this vulnerability.
The entry VDB-132806 is related to this item. If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Product
Type
Vendor
Name
Version
License
Website
- Vendor: https://www.apple.com/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 6.5VulDB Meta Temp Score: 6.3
VulDB Base Score: 6.5
VulDB Temp Score: 6.2
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 6.5
NVD Vector: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Input validationCWE: CWE-20
CAPEC: 🔍
ATT&CK: 🔍
Physical: No
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: Safari 11.1.2
Timeline
01/02/2018 🔍09/17/2018 🔍
04/03/2019 🔍
04/04/2019 🔍
08/25/2023 🔍
Sources
Vendor: apple.comAdvisory: support.apple.com
Status: Not defined
CVE: CVE-2018-4362 (🔍)
GCVE (CVE): GCVE-0-2018-4362
GCVE (VulDB): GCVE-100-132949
See also: 🔍
Entry
Created: 04/04/2019 10:30Updated: 08/25/2023 09:27
Changes: 04/04/2019 10:30 (57), 05/25/2020 11:49 (1), 08/25/2023 09:27 (4)
Complete: 🔍
Cache ID: 216::103
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
No comments yet. Languages: en.
Please log in to comment.