PT-2023-6516 · Apple · Music

Hluwa + 1 · Published 2023-07-28 · Updated 2023-08-03 · CVE-2023-28203

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple Music versions prior to 4.2.0

Description The issue is related to insufficient access control in the Apple Music app for Android, which may allow an app to access a user's contacts. This could potentially lead to the disclosure of user contact information.

Recommendations For versions prior to 4.2.0, update to Apple Music 4.2.0 for Android to resolve the issue.

Fix

Improper Access Control

Information Disclosure

Weakness Enumeration

CWE-284

CWE-200

Related Identifiers

BDU:2023-07263

CVE-2023-28203

Affected Products

Music

References · 6

• https://osv.dev/vulnerability/CVE-2023-28203 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28203 · Security Note
• https://bdu.fstec.ru/vul/2023-07263 · Security Note
• https://support.apple.com/en-us/HT213833 · Vendor Advisory
• https://t.me/cvenotify/55408 · Telegram Post
• https://t.me/cvenotify/55418 · Telegram Post