PT-2017-17542 · Apple+1 · Isupport+1

David Coomber · Publicado 2017-10-23 · Atualizado 2019-10-03 · CVE-2017-7147

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple Support app version 1.1 and earlier

Description The issue involves the Analytics component and allows remote attackers to obtain sensitive analytics information. This is possible because the information is transmitted in cleartext HTTP to an Adobe Marketing Cloud server operated for Apple. The sensitive information that can be obtained includes details about the installation date and time.

Recommendations For Apple Support app version 1.1 and earlier, update to version 1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Analytics component until the update is applied.

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2017-7147

Produtos afetados

Marketing Cloud

Isupport

Referências · 5

• http://securityfocus.com/bid/101533 · Nota
• https://support.apple.com/HT208201 · Aviso do Fabricante
• https://info-sec.ca/advisories/Apple-Support.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7147 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-7147 · Aviso do Fabricante