CVE-2020-9800: 
Apple iCloud vulnerability analysis and mitigation

CVE-2020-9800 is a type confusion vulnerability discovered in WebKit, affecting multiple Apple products. The vulnerability was disclosed and patched in May 2020, affecting iOS 13.5, iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, and iCloud for Windows 7.19. The vulnerability was discovered by Brendan Draper (@6r3nd4n) working with Trend Micro Zero Day Initiative (Apple Support).

The vulnerability is classified as a type confusion issue in WebKit, Apple's browser engine. The issue was addressed with improved memory handling. According to the National Vulnerability Database, the vulnerability has a CVSS v3.1 Base Score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

When successfully exploited, processing maliciously crafted web content may lead to arbitrary code execution. This means an attacker could potentially execute unauthorized code on the affected system through specially crafted web content (Apple Support).

The vulnerability requires user interaction (such as visiting a malicious webpage) and can be exploited remotely. The attack complexity is considered low, requiring no special privileges for exploitation (NVD).

Apple addressed this vulnerability by releasing security updates for all affected products. Users should update to iOS 13.5, iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, or iCloud for Windows 7.19, depending on their device (Apple Support).