CVE-2017-7152

An issue was discovered in certain Apple products. iOS before 11.2 is affected. The issue involves the "Mail Message Framework" component. It allows remote attackers to spoof the address bar via a crafted web site.

CVSS v3.0 4.3 MEDIUM
CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v3.0 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://support.apple.com/HT208334	Vendor Advisory
https://support.apple.com/kb/HT210724
https://support.apple.com/kb/HT210721
https://support.apple.com/kb/HT210722
http://seclists.org/fulldisclosure/2019/Oct/54
http://seclists.org/fulldisclosure/2019/Oct/49
http://seclists.org/fulldisclosure/2019/Oct/56

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

Information

Published : 2017-12-27 09:08

Updated : 2019-10-29 20:15

NVD link : CVE-2017-7152

Mitre link : CVE-2017-7152

JSON object : View

CWE

NVD-CWE-noinfo

Advertisement

Products Affected

apple

iphone_os

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://support.apple.com/HT208334", "name": "https://support.apple.com/HT208334", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "https://support.apple.com/kb/HT210724", "name": "https://support.apple.com/kb/HT210724", "tags": [], "refsource": "CONFIRM"}, {"url": "https://support.apple.com/kb/HT210721", "name": "https://support.apple.com/kb/HT210721", "tags": [], "refsource": "CONFIRM"}, {"url": "https://support.apple.com/kb/HT210722", "name": "https://support.apple.com/kb/HT210722", "tags": [], "refsource": "CONFIRM"}, {"url": "http://seclists.org/fulldisclosure/2019/Oct/54", "name": "20191031 APPLE-SA-2019-10-29-4 watchOS 6.1", "tags": [], "refsource": "FULLDISC"}, {"url": "http://seclists.org/fulldisclosure/2019/Oct/49", "name": "20191031 APPLE-SA-2019-10-29-1 iOS 13.2 and iPadOS 13.2", "tags": [], "refsource": "FULLDISC"}, {"url": "http://seclists.org/fulldisclosure/2019/Oct/56", "name": "20191031 APPLE-SA-2019-10-29-2 macOS Catalina 10.15.1, Security Update 2019-001 Mojave, Security Update 2019-006 High Sierra", "tags": [], "refsource": "FULLDISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "An issue was discovered in certain Apple products. iOS before 11.2 is affected. The issue involves the \"Mail Message Framework\" component. It allows remote attackers to spoof the address bar via a crafted web site."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2017-7152", "ASSIGNER": "product-security@apple.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}}, "publishedDate": "2017-12-27T17:08Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "11.2"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2019-10-30T03:15Z"}