Sign-up

ID

VAR-202002-1159


CVE

CVE-2020-3833


TITLE

Safari User Interface Mismatch Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2020-002280

DESCRIPTION

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 13.0.5. Visiting a malicious website may lead to address bar spoofing. Safari Contains a user interface mismatch vulnerability due to poor state management.malicious Web Accessing the site can spoof the address bar. Apple Safari is a web browser of Apple (Apple), the default browser included with Mac OS X and iOS operating systems. A security vulnerability exists in versions of Apple Safari prior to 13.0.5. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-1-28-5 Safari 13.0.5 Safari 13.0.5 is now available and addresses the following: Safari Available for: macOS Mojave and macOS High Sierra, and included in macOS Catalina Impact: Visiting a malicious website may lead to address bar spoofing Description: An inconsistent user interface issue was addressed with improved state management. CVE-2020-3833: Nikhil Mittal (@c0d3G33k) of Payatu Labs (payatu.com) Safari Login AutoFill Available for: macOS Mojave and macOS High Sierra, and included in macOS Catalina Impact: A local user may unknowingly send a password unencrypted over the network Description: The issue was addressed with improved UI handling. CVE-2020-3841: Sebastian Bicchi (@secresDoge) from Sec-Research Installation note: Safari 13.0.5 may be obtained from the Mac App Store. Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4whoIACgkQBz4uGe3y 0M2ULA//fbYU/AYMEqzVZp/rYswUq6jqLzZoF42t6fiSUsAx4SeXvY/6r7Zod3PU WSZ8wE2x8DKTOA0bZO1NTqTaCJbAuwcaOwlpBUmvMUdGgO19jtqiYVx9vFvRx/xW dgDPEzCTFFw/23L6uTcKyQT2MCuJvotDYjuRUmOZ5Aq8udlq2SJPS4IeW8hZIFVX Q63ooRgGT3HxdsCjcsYIoJhpcdqOu6VbzoyxnK6SAr4VoxiJAIvzmE12IWTYyIjf x784W4w6/jM0NqG4DNQdymFnaiHMGb4BA+UFDWLAY06Ij8So9oEG+VfpyNBF0OgW wTk7XBlpoMFVXjii4hPoJUHeKuyacU0+9V59i/Nbq7xS0FuyEfVtqdYpnevMdxDO v4kEzelHRsT316gxsp8PFleB57ImVQAFy3xA5eNciZRsI03RwLNmUI7PItwaRe9b opYwsdt5Eoo69R2RhM/3OpV0tRToQ6eHMjT9HY4qyOkieMNt2G3JhT8N7aTm+l2P K7oZkuvm3nY6rEPEmDrao+diz/N8Z7pCAX+AH0tAOMQzQKj4i20hSqmToGYSFBLO BS9i9+nwqqT/Iggiq0cTeNf8h3MhuoI0CZL9QKpnWxoPYKJCQXvfAQoIjOZ9u3p7 O5FoMzuilQ2UGqcxwDm0iBUDq6ZkKo+cUsNW3+siHcD2yr++N60=zlOg -----END PGP SIGNATURE-----

Trust: 1.89

sources: NVD: CVE-2020-3833 // JVNDB: JVNDB-2020-002280 // VULHUB: VHN-181958 // VULMON: CVE-2020-3833 // PACKETSTORM: 156128

AFFECTED PRODUCTS

vendor:applemodel:safariscope:ltversion:13.0.5

Trust: 1.0

vendor:applemodel:safariscope:eqversion:13.0.5 未満 (macos mojave)

Trust: 0.8

vendor:applemodel:safariscope:eqversion:13.0.5 未満 (macos high sierra)

Trust: 0.8

vendor:applemodel:safariscope:eqversion:13.0.5 未満 (macos catalina)

Trust: 0.8

sources: JVNDB: JVNDB-2020-002280 // NVD: CVE-2020-3833

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-3833
value: MEDIUM

Trust: 1.0

NVD: JVNDB-2020-002280
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202001-1456
value: MEDIUM

Trust: 0.6

VULHUB: VHN-181958
value: MEDIUM

Trust: 0.1

VULMON: CVE-2020-3833
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-3833
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

NVD: JVNDB-2020-002280
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-181958
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-3833
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 1.4
version: 3.1

Trust: 1.0

NVD: JVNDB-2020-002280
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-181958 // VULMON: CVE-2020-3833 // JVNDB: JVNDB-2020-002280 // CNNVD: CNNVD-202001-1456 // NVD: CVE-2020-3833

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:CWE-Other

Trust: 0.8

sources: JVNDB: JVNDB-2020-002280 // NVD: CVE-2020-3833

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202001-1456

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202001-1456

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2020-002280

PATCH
title:HT210922url:https://support.apple.com/en-us/HT210922
Trust: 0.8
title:HT210922url:https://support.apple.com/ja-jp/HT210922
Trust: 0.8
title:Apple Safari Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=110897
Trust: 0.6
title:Apple: Safari 13.0.5url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=3f902bb6cd16baac72cd850a5c850a34
Trust: 0.1
title:Safari-Address-Bar-Spoof-CVE-2020-3833-url:https://github.com/c0d3G33k/Safari-Address-Bar-Spoof-CVE-2020-3833- 
Trust: 0.1
title:PoCurl:https://github.com/Jonathan-Elias/PoC 
Trust: 0.1
title:CVE-POCurl:https://github.com/0xT11/CVE-POC 
Trust: 0.1
title:PoC-in-GitHuburl:https://github.com/nomi-sec/PoC-in-GitHub 
Trust: 0.1
title:PoC-in-GitHuburl:https://github.com/hectorgie/PoC-in-GitHub 
Trust: 0.1
sources:
            
            
            VULMON: CVE-2020-3833 // 
            
            
            
            JVNDB: JVNDB-2020-002280 // 
            
            
            
            CNNVD: CNNVD-202001-1456

EXTERNAL IDS
db:NVDid:CVE-2020-3833
Trust: 2.7
db:PACKETSTORMid:156128
Trust: 0.8
db:JVNid:JVNVU95678717
Trust: 0.8
db:JVNDBid:JVNDB-2020-002280
Trust: 0.8
db:CNNVDid:CNNVD-202001-1456
Trust: 0.7
db:AUSCERTid:ESB-2020.0356
Trust: 0.6
db:CNVDid:CNVD-2020-07199
Trust: 0.1
db:VULHUBid:VHN-181958
Trust: 0.1
db:VULMONid:CVE-2020-3833
Trust: 0.1
sources:
            
            
            VULHUB: VHN-181958 // 
            
            
            
            VULMON: CVE-2020-3833 // 
            
            
            
            JVNDB: JVNDB-2020-002280 // 
            
            
            
            PACKETSTORM: 156128 // 
            
            
            
            CNNVD: CNNVD-202001-1456 // 
            
            
            
            NVD: CVE-2020-3833

REFERENCES
url:https://support.apple.com/ht210922
Trust: 1.8
url:https://nvd.nist.gov/vuln/detail/cve-2020-3833
Trust: 1.5
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-3833
Trust: 0.8
url:https://jvn.jp/vu/jvnvu95678717/
Trust: 0.8
url:https://support.apple.com/en-au/ht210922
Trust: 0.6
url:https://support.apple.com/en-us/ht210922
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2020.0356/
Trust: 0.6
url:https://packetstormsecurity.com/files/156128/apple-security-advisory-2020-1-28-5.html
Trust: 0.6
url:https://cwe.mitre.org/data/definitions/.html
Trust: 0.1
url:https://github.com/c0d3g33k/safari-address-bar-spoof-cve-2020-3833-
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://github.com/nomi-sec/poc-in-github
Trust: 0.1
url:https://support.apple.com/kb/ht210922
Trust: 0.1
url:https://support.apple.com/kb/ht201222
Trust: 0.1
url:https://www.apple.com/support/security/pgp/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3841
Trust: 0.1
sources:
            
            
            VULHUB: VHN-181958 // 
            
            
            
            VULMON: CVE-2020-3833 // 
            
            
            
            JVNDB: JVNDB-2020-002280 // 
            
            
            
            PACKETSTORM: 156128 // 
            
            
            
            CNNVD: CNNVD-202001-1456 // 
            
            
            
            NVD: CVE-2020-3833

CREDITS
Apple,Nikhil Mittal (@c0d3G33k) of Payatu Labs (payatu.com)
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-202001-1456

SOURCES
db:VULHUBid:VHN-181958
db:VULMONid:CVE-2020-3833
db:JVNDBid:JVNDB-2020-002280
db:PACKETSTORMid:156128
db:CNNVDid:CNNVD-202001-1456
db:NVDid:CVE-2020-3833

LAST UPDATE DATE
2024-11-23T21:29:48.563000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-181958date:2020-03-02T00:00:00
db:VULMONid:CVE-2020-3833date:2020-03-02T00:00:00
db:JVNDBid:JVNDB-2020-002280date:2020-03-11T00:00:00
db:CNNVDid:CNNVD-202001-1456date:2021-10-29T00:00:00
db:NVDid:CVE-2020-3833date:2024-11-21T05:31:48.433

SOURCES RELEASE DATE
db:VULHUBid:VHN-181958date:2020-02-27T00:00:00
db:VULMONid:CVE-2020-3833date:2020-02-27T00:00:00
db:JVNDBid:JVNDB-2020-002280date:2020-03-11T00:00:00
db:PACKETSTORMid:156128date:2020-01-29T17:16:14
db:CNNVDid:CNNVD-202001-1456date:2020-01-31T00:00:00
db:NVDid:CVE-2020-3833date:2020-02-27T21:15:16.367