Low severity · published Apr 2, 2017
CVE-2017-2383
An issue was discovered in certain Apple products
3.1
CVSS
0.4%
EPSS
No
On KEV
Description
An issue was discovered in certain Apple products. iCloud before 6.2 on Windows is affected. iTunes before 12.6 on Windows is affected. The issue involves cleartext client-certificate transmission in the "APNs Server" component. It allows man-in-the-middle attackers to track users via correlation with this certificate.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
Icloud · Apple
through 6.1.1 · source: NVD
IT
Itunes · Apple
through 12.5.5.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-2383
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-2383
Third Party Advisory
http://www.securityfocus.com/bid/97175
www.securitytracker.com
http://www.securitytracker.com/id/1038157
Vendor Advisory
https://support.apple.com/HT207599
Vendor Advisory
https://support.apple.com/HT207607
More from Icloud
8.8
CVE-2019-8506
Apple Multiple Products Type Confusion Vulnerability
7.8
CVE-2020-27932
Apple Multiple Products Type Confusion Vulnerability
9.8
CVE-2019-8756
Multiple memory corruption issues were addressed with improved input validation
9.8
CVE-2019-8749
Multiple memory corruption issues were addressed with improved input validation
9.8
CVE-2019-8746
An out-of-bounds read was addressed with improved input validation