CVE-2020-9802: 
Apple iCloud vulnerability analysis and mitigation

CVE-2020-9802 is a logic issue in WebKit that was discovered and fixed in May 2020. The vulnerability affects multiple Apple products including iOS 13.5, iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, and iCloud for Windows 7.19. The vulnerability was discovered by Samuel Groß of Google Project Zero (Apple Security).

The vulnerability is a logic issue in WebKit, Apple's browser engine. The issue was addressed with improved restrictions in the WebKit component. The vulnerability has a CVSS v3.1 Base Score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, no privileges required, and user interaction required (NVD).

Processing maliciously crafted web content may lead to arbitrary code execution. This means an attacker could potentially execute arbitrary code on the affected system if a user visits a maliciously crafted webpage (Apple Security).

The vulnerability requires user interaction (visiting a malicious webpage) and is network accessible. The attack complexity is considered low, requiring no special privileges for exploitation (NVD).

Apple addressed this vulnerability by improving restrictions in the WebKit component. Users should update to iOS 13.5, iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, or iCloud for Windows 7.19, depending on their device (Apple Security).