Server-side request forgery in Apple iOS - CVE-2017-13903
Published: December 8, 2017 / Updated: December 18, 2017
Vulnerability identifier: #VU9592
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2017-13903
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Apple Inc.
Affected software:
Apple iOS
Apple iOS
Detailed vulnerability description
The vulnerability allows a remote user to perform SSRF attack.
The weakness exists due to unknown error. A remote attacker can perform SSRF attack to bypass network access controls, perform unauthorized connections to local resources, gain access to sensitive information and compromise vulnerable system.
The weakness exists due to unknown error. A remote attacker can perform SSRF attack to bypass network access controls, perform unauthorized connections to local resources, gain access to sensitive information and compromise vulnerable system.
How to mitigate CVE-2017-13903
Update to version 11.2.1.