CVE-2018-4319 Cross-site scripting in iOS, watchOS, Safari, iTunes for Windows, iCloud for Windows

High 8.1 Published 3 Apr 2019 Updated 5 Aug 2024

An attacker could exploit a cross-origin issue in iframes to bypass security origin tracking in Apple browsers and related applications.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2018-4319?

CVE-2018-4319 is a high-severity cross-site scripting vulnerability in Apple Icloud, published on 3 Apr 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue affected versions prior to iOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.

Weakness: CWE-346

Which versions are affected by CVE-2018-4319?

It affects 4 products.

Products include Apple Icloud, Apple Iphone Os, Apple Itunes, Apple Safari.

How do I fix CVE-2018-4319?

Upgrade to a fixed version.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2018-4319 being exploited?

There is no known exploitation of CVE-2018-4319 in the wild and no public exploit code.

All Apple Icloud vulnerabilities

Sources

Also known as DEBIAN-CVE-2018-4319, GHSA-hgf5-w332-962x, UBUNTU-CVE-2018-4319.