CVE-2020-9915 - webkitgtk: Access issue in content security policy

Back Back to CVE browser

MEDIUM

webkitgtk: Access issue in content security policy

Published Oct 16, 2020

6.5

MEDIUM

CVSS 3.1

EPSS 1.50%

Description

An access issue existed in Content Security Policy. This issue was addressed with improved access restrictions. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

Affected products

Vendor Apple Product Safari Default
unknown
Affected
- ≥ unspecified, < Safari 13.1.2
Vendor Apple Product iCloud for Windows Default
unknown
Affected
- ≥ unspecified, < iCloud for Windows 11.3
Vendor Apple Product iCloud for Windows (Legacy) Default
unknown
Affected
- ≥ unspecified, < iCloud for Windows 7.20
Vendor Apple Product iOS Default
unknown
Affected
- ≥ unspecified, < iOS 13.6 and iPadOS 13.6
Vendor Apple Product iTunes for Windows Default
unknown
Affected
- ≥ unspecified, < iTunes 12.10.8 for Windows
Vendor Apple Product tvOS Default
unknown
Affected
- ≥ unspecified, < tvOS 13.4.8
Vendor Apple Product watchOS Default
unknown
Affected
- ≥ unspecified, < watchOS 6.2.8

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Apple	Safari	unknown	Affected ≥ unspecified, < Safari 13.1.2
Apple	iCloud for Windows	unknown	Affected ≥ unspecified, < iCloud for Windows 11.3
Apple	iCloud for Windows (Legacy)	unknown	Affected ≥ unspecified, < iCloud for Windows 7.20
Apple	iOS	unknown	Affected ≥ unspecified, < iOS 13.6 and iPadOS 13.6
Apple	iTunes for Windows	unknown	Affected ≥ unspecified, < iTunes 12.10.8 for Windows
Apple	tvOS	unknown	Affected ≥ unspecified, < tvOS 13.4.8
Apple	watchOS	unknown	Affected ≥ unspecified, < watchOS 6.2.8

Red Hat Enterprise Linux 7 Extended Lifecycle Support

webkitgtk4-0:2.48.3-2.el7_9

Fixed · RHSA-2025:10364
Red Hat Enterprise Linux 8

webkit2gtk3-0:2.28.4-1.el8

Fixed · RHSA-2020:4451
Red Hat Enterprise Linux 6

webkitgtk

Out of support scope
Red Hat Enterprise Linux 7

webkitgtk3

Will not fix

Product	Package	State	Advisory
Red Hat Enterprise Linux 7 Extended Lifecycle Support	webkitgtk4-0:2.48.3-2.el7_9	Fixed	RHSA-2025:10364
Red Hat Enterprise Linux 8	webkit2gtk3-0:2.28.4-1.el8	Fixed	RHSA-2020:4451
Red Hat Enterprise Linux 6	webkitgtk	Out of support scope	n/a
Red Hat Enterprise Linux 7	webkitgtk3	Will not fix	n/a

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-284

References (13)

https://access.redhat.com/security/cve/CVE-2020-9915
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1879540
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-30694
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-9915
https://support.apple.com/HT211288
x_refsource_MISCRelease NotesVendor Advisory
https://support.apple.com/HT211290
x_refsource_MISCRelease NotesVendor Advisory
https://support.apple.com/HT211291
x_refsource_MISCRelease NotesVendor Advisory
https://support.apple.com/HT211292
x_refsource_MISCRelease NotesVendor Advisory
https://support.apple.com/HT211293
x_refsource_MISCRelease NotesVendor Advisory
https://support.apple.com/HT211294
x_refsource_MISCRelease NotesVendor Advisory
https://support.apple.com/HT211295
x_refsource_MISCRelease NotesVendor Advisory
https://webkitgtk.org/security/WSA-2020-0007.html
https://www.cve.org/CVERecord?id=CVE-2020-9915

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2020-9915		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1879540		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-30694		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-9915
https://support.apple.com/HT211288		x_refsource_MISCRelease NotesVendor Advisory
https://support.apple.com/HT211290		x_refsource_MISCRelease NotesVendor Advisory
https://support.apple.com/HT211291		x_refsource_MISCRelease NotesVendor Advisory
https://support.apple.com/HT211292		x_refsource_MISCRelease NotesVendor Advisory
https://support.apple.com/HT211293		x_refsource_MISCRelease NotesVendor Advisory
https://support.apple.com/HT211294		x_refsource_MISCRelease NotesVendor Advisory
https://support.apple.com/HT211295		x_refsource_MISCRelease NotesVendor Advisory
https://webkitgtk.org/security/WSA-2020-0007.html
https://www.cve.org/CVERecord?id=CVE-2020-9915

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner apple

Published Oct 16, 2020

Updated Aug 4, 2024

Reserved Mar 2, 2020

Link CVE-2020-9915

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-9915

Red Hat

Severity Moderate

Public date Jul 29, 2020

Bugzilla 1879540

Link CVE-2020-9915

ENISA EUVD

Assigner apple

Published Oct 16, 2020

Updated Aug 4, 2024

Link EUVD-2020-30694

GitHub

No data