CVE-2018-4397 Information disclosure in Apple Support app
Analytics data was transmitted over unencrypted HTTP, allowing attackers to intercept sensitive usage information from the Apple Support app.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-4397?
CVE-2018-4397 is a medium-severity vulnerability in Apple Support app, published on 3 Apr 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Analytics data was sent using HTTP rather than HTTPS. This was addressed by sending analytics data using HTTPS. This issue affected versions prior to Apple Support 2.4 for iOS.
Weakness: CWE-20
Which versions are affected by CVE-2018-4397?
It affects 1 product.
Products include Apple Apple Support.
How do I fix CVE-2018-4397?
No fix has been published for CVE-2018-4397 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-4397 being exploited?
There is no known exploitation of CVE-2018-4397 in the wild and no public exploit code.
Other vulnerabilities in Apple Support app
Sources
Also known as GHSA-g665-9726-cg3r.