CVEvulnerability
CVE-2020-10003
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-12-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 4.6 MEDIUM — AV:L/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-59
Description
An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.2 and iPadOS 14.2, tvOS 14.2, watchOS 7.1. A local attacker may be able to elevate their privileges.
Affected configurations
• apple ipados (< 14.2)
• apple iphone os (< 14.2)
• apple mac os x (< 11.0.1)
• apple tvos (< 14.2)
• apple watchos (< 7.1)
Related
Weakness · CWE (1)
- CWE-59 Improper Link Resolution Before File Access weakness
References
- http://seclists.org/fulldisclosure/2020/Dec/32 Mailing List, Third Party Advisory
- https://support.apple.com/en-us/HT211928 Vendor Advisory
- https://support.apple.com/en-us/HT211929 Vendor Advisory
- https://support.apple.com/en-us/HT211930 Vendor Advisory
- https://support.apple.com/en-us/HT211931 Vendor Advisory
- http://seclists.org/fulldisclosure/2020/Dec/32 Mailing List, Third Party Advisory
- https://support.apple.com/en-us/HT211928 Vendor Advisory
- https://support.apple.com/en-us/HT211929 Vendor Advisory
- https://support.apple.com/en-us/HT211930 Vendor Advisory
- https://support.apple.com/en-us/HT211931 Vendor Advisory