CVE-2019-8649

{"containers": {"cna": {"affected": [{"product": "iOS", "vendor": "Apple", "versions": [{"lessThan": "iOS 12.4", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "macOS", "vendor": "Apple", "versions": [{"lessThan": "macOS Mojave 10.14.6", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "tvOS", "vendor": "Apple", "versions": [{"lessThan": "tvOS 12.4", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Safari", "vendor": "Apple", "versions": [{"lessThan": "Safari 12.1.2", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "iTunes for Windows", "vendor": "Apple", "versions": [{"lessThan": "iTunes for Windows 12.9.6", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "iCloud for Windows", "vendor": "Apple", "versions": [{"lessThan": "iCloud for Windows 7.13", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "iCloud for Windows (Microsoft Store)", "vendor": "Apple", "versions": [{"lessThan": "iCloud for Windows 10.6", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "A logic issue existed in the handling of synchronous page loads. This issue was addressed with improved state management. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to universal cross site scripting."}], "problemTypes": [{"descriptions": [{"description": "Processing maliciously crafted web content may lead to universal cross site scripting", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-12-18T17:33:20.000Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://support.apple.com/HT210346"}, {"tags": ["x_refsource_MISC"], "url": "https://support.apple.com/HT210348"}, {"tags": ["x_refsource_MISC"], "url": "https://support.apple.com/HT210351"}, {"tags": ["x_refsource_MISC"], "url": "https://support.apple.com/HT210355"}, {"tags": ["x_refsource_MISC"], "url": "https://support.apple.com/HT210356"}, {"tags": ["x_refsource_MISC"], "url": "https://support.apple.com/HT210357"}, {"tags": ["x_refsource_MISC"], "url": "https://support.apple.com/HT210358"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "product-security@apple.com", "ID": "CVE-2019-8649", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "iOS", "version": {"version_data": [{"version_affected": "<", "version_value": "iOS 12.4"}]}}, {"product_name": "macOS", "version": {"version_data": [{"version_affected": "<", "version_value": "macOS Mojave 10.14.6"}]}}, {"product_name": "tvOS", "version": {"version_data": [{"version_affected": "<", "version_value": "tvOS 12.4"}]}}, {"product_name": "Safari", "version": {"version_data": [{"version_affected": "<", "version_value": "Safari 12.1.2"}]}}, {"product_name": "iTunes for Windows", "version": {"version_data": [{"version_affected": "<", "version_value": "iTunes for Windows 12.9.6"}]}}, {"product_name": "iCloud for Windows", "version": {"version_data": [{"version_affected": "<", "version_value": "iCloud for Windows 7.13"}]}}, {"product_name": "iCloud for Windows (Microsoft Store)", "version": {"version_data": [{"version_affected": "<", "version_value": "iCloud for Windows 10.6"}]}}]}, "vendor_name": "Apple"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A logic issue existed in the handling of synchronous page loads. This issue was addressed with improved state management. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to universal cross site scripting."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Processing maliciously crafted web content may lead to universal cross site scripting"}]}]}, "references": {"reference_data": [{"name": "https://support.apple.com/HT210346", "refsource": "MISC", "url": "https://support.apple.com/HT210346"}, {"name": "https://support.apple.com/HT210348", "refsource": "MISC", "url": "https://support.apple.com/HT210348"}, {"name": "https://support.apple.com/HT210351", "refsource": "MISC", "url": "https://support.apple.com/HT210351"}, {"name": "https://support.apple.com/HT210355", "refsource": "MISC", "url": "https://support.apple.com/HT210355"}, {"name": "https://support.apple.com/HT210356", "refsource": "MISC", "url": "https://support.apple.com/HT210356"}, {"name": "https://support.apple.com/HT210357", "refsource": "MISC", "url": "https://support.apple.com/HT210357"}, {"name": "https://support.apple.com/HT210358", "refsource": "MISC", "url": "https://support.apple.com/HT210358"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T21:24:29.499Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.apple.com/HT210346"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.apple.com/HT210348"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.apple.com/HT210351"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.apple.com/HT210355"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.apple.com/HT210356"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.apple.com/HT210357"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.apple.com/HT210358"}]}]}, "cveMetadata": {"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2019-8649", "datePublished": "2019-12-18T17:33:20.000Z", "dateReserved": "2019-02-18T00:00:00.000Z", "dateUpdated": "2024-08-04T21:24:29.499Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "iOS", "vendor": "Apple", "versions": [{"lessThan": "iOS 12.4", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "macOS", "vendor": "Apple", "versions": [{"lessThan": "macOS Mojave 10.14.6", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "tvOS", "vendor": "Apple", "versions": [{"lessThan": "tvOS 12.4", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Safari", "vendor": "Apple", "versions": [{"lessThan": "Safari 12.1.2", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "iTunes for Windows", "vendor": "Apple", "versions": [{"lessThan": "iTunes for Windows 12.9.6", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "iCloud for Windows", "vendor": "Apple", "versions": [{"lessThan": "iCloud for Windows 7.13", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "iCloud for Windows (Microsoft Store)", "vendor": "Apple", "versions": [{"lessThan": "iCloud for Windows 10.6", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "product-security@apple.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*", "matchCriteriaId": "086B8913-51FE-4FCA-AB2C-47541F2C3252", "versionEndExcluding": "7.13", "vulnerable": true}, {"criteria": "cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*", "matchCriteriaId": "71143206-77A6-4B8F-964B-FD4E00C1AE60", "versionEndExcluding": "10.6", "versionStartIncluding": "10.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:*", "matchCriteriaId": "F3310BC8-34F6-4C8A-B6B8-FCEB9033902B", "versionEndExcluding": "12.9.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*", "matchCriteriaId": "11DC97B1-0EC4-4DCE-999C-743D64E4D108", "versionEndExcluding": "12.1.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "matchCriteriaId": "78127EE5-23FE-4C66-B7EE-2CF3E19F0503", "versionEndExcluding": "12.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*", "matchCriteriaId": "B0E97851-4DFF-4852-A339-183331F4ACBC", "versionEndExcluding": "10.14.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC281794-DEC0-4C8A-8B92-F8E5D8785EF6", "versionEndExcluding": "12.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A logic issue existed in the handling of synchronous page loads. This issue was addressed with improved state management. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to universal cross site scripting."}, {"lang": "es", "value": "Se present\u00f3 un problema l\u00f3gico en el manejo de cargas de p\u00e1ginas s\u00edncronas. Este problema fue abordado con una mejor gesti\u00f3n del estado. Este problema es corregido en iOS versi\u00f3n 12.4, macOS Mojave versi\u00f3n 10.14.6, tvOS versi\u00f3n 12.4, Safari versi\u00f3n 12.1.2, iTunes para Windows versi\u00f3n 12.9.6, iCloud para Windows versi\u00f3n 7.13, iCloud para Windows versi\u00f3n 10.6. El procesamiento de contenido web dise\u00f1ado maliciosamente puede conllevar a un ataque de tipo cross site scripting universal."}], "id": "CVE-2019-8649", "lastModified": "2026-06-17T02:42:19.183", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-12-18T18:15:31.257", "references": [{"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT210346"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT210348"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT210351"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT210355"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT210356"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT210357"}, {"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT210358"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT210346"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT210348"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT210351"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT210355"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT210356"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT210357"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/HT210358"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2020:4035", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "webkitgtk4-0:2.28.2-2.el7", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2020-09-29T00:00:00Z"}, {"advisory": "RHEA-2019:4262", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "webkit2gtk3-0:2.24.4-2.el8_1", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2019-12-17T00:00:00Z"}], "bugzilla": {"description": "webkitgtk: Incorrect state management leading to universal cross-site scripting", "id": "1876628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1876628"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "status": "verified"}, "details": ["A logic issue existed in the handling of synchronous page loads. This issue was addressed with improved state management. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to universal cross site scripting."], "name": "CVE-2019-8649", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Will not fix", "package_name": "webkitgtk", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Will not fix", "package_name": "webkitgtk3", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2019-08-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2019-8649\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-8649\nhttps://webkitgtk.org/security/WSA-2019-0004.html"], "threat_severity": "Moderate"}

{}