CVEvulnerability
CVE-2013-3948
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2013-06-05
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-20
Description
Apple iOS 6.1.3 does not follow redirects during determination of the hostname to display in an iOS Enterprise Deployment installation dialog, which makes it easier for remote attackers to trigger installation of arbitrary applications via a download-manifest itms-services:// URL that leverages an open redirect vulnerability within a trusted domain.
Affected configurations
• apple iphone os 6.1.3
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://antid0te.com/syscan_2013/SyScan2013_Mountain_Lion_iOS_Vulnerabilities_Garage_Sale_Whitepaper.pdf Exploit
- http://support.apple.com/kb/HT6162 support.apple.com
- http://www.syscan.org/index.php/sg/program/day/2 www.syscan.org
- http://antid0te.com/syscan_2013/SyScan2013_Mountain_Lion_iOS_Vulnerabilities_Garage_Sale_Whitepaper.pdf Exploit
- http://support.apple.com/kb/HT6162 support.apple.com
- http://www.syscan.org/index.php/sg/program/day/2 www.syscan.org