Vulnerability Details : CVE-2017-2475
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted use of frames on a web site.
Vulnerability category: Cross site scripting (XSS)
Exploit prediction scoring system (EPSS) score for CVE-2017-2475
Probability of exploitation activity in the next 30 days: 0.21%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 58 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2017-2475
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
6.1
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
2.8
|
2.7
|
NIST |
CWE ids for CVE-2017-2475
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-2475
-
https://support.apple.com/HT207601
About the security content of tvOS 10.2 - Apple SupportVendor Advisory
-
https://security.gentoo.org/glsa/201706-15
WebKitGTK+: Multiple vulnerabilities (GLSA 201706-15) — Gentoo securityThird Party Advisory
-
http://www.securitytracker.com/id/1038137
Apple Safari Multiple Bugs Let Remote Users Obtain Potentially Sensitive Information, Conduct Cross-Site Scripting Attacks, Bypass Security, Deny Service, and Execute Arbitrary Code - SecurityTrackerThird Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/97130
WebKit Multiple Security VulnerabilitiesThird Party Advisory;VDB Entry
-
https://support.apple.com/HT207617
About the security content of iOS 10.3 - Apple SupportVendor Advisory
-
https://support.apple.com/HT207600
About the security content of Safari 10.1 - Apple SupportVendor Advisory
Products affected by CVE-2017-2475
- cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*