CVE-2017-7147

{"id": "CVE-2017-7147", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": true, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2017-10-23T01:29:14.080", "references": [{"url": "http://www.securityfocus.com/bid/101533", "tags": ["Third Party Advisory", "VDB Entry"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/HT208201", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://www.info-sec.ca/advisories/Apple-Support.html", "tags": ["Third Party Advisory"], "source": "product-security@apple.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in certain Apple products. The Apple Support app before 1.2 for iOS is affected. The issue involves the \"Analytics\" component. It allows remote attackers to obtain sensitive analytics information by leveraging its presence in a cleartext HTTP transmission to an Adobe Marketing Cloud server operated for Apple, as demonstrated by information about the installation date and time."}, {"lang": "es", "value": "Se ha descubierto un problema en ciertos productos Apple.. Se ha visto afectada la versi\u00f3n de la app Apple Support para iOS anterior a 1.2. El problema implica el componente \"Analytics\". Permite que atacantes remotos obtengan informaci\u00f3n sensible de an\u00e1lisis aprovechando su presencia en una transmisi\u00f3n en un HTTP en texto claro a un servidor Adobe Marketing Cloud gestionado para Apple. Esto se demuestra mediante la informaci\u00f3n sobre la fecha y hora de instalaci\u00f3n."}], "lastModified": "2019-10-03T00:03:26.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apple:apple_support:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4F6ECBE8-86D5-4D69-A257-2D841D9849EE", "versionEndIncluding": "1.1.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "340C4071-1447-477F-942A-8E09EA29F917"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "product-security@apple.com"}