CVE-2018-4429 Other in iOS, watchOS

Medium 6.5 Published 3 Apr 2019 Updated 5 Aug 2024

Attackers can spoof URLs due to improper input validation, potentially misleading users about the true destination of links.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2018-4429?

CVE-2018-4429 is a medium-severity vulnerability in Apple Iphone Os, published on 3 Apr 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue affected versions prior to iOS 12.1.1, watchOS 5.1.2.

Weakness: CWE-20

Which versions are affected by CVE-2018-4429?

It affects 2 products.

Products include Apple Iphone Os, Apple Watchos.

How do I fix CVE-2018-4429?

No fix has been published for CVE-2018-4429 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-4429 being exploited?

There is no known exploitation of CVE-2018-4429 in the wild and no public exploit code.

All Apple Iphone Os vulnerabilities

Sources

Also known as GHSA-v2p2-x547-vr26.