CVE-2020-9916: 
Apple iCloud vulnerability analysis and mitigation

A URL Unicode encoding issue (CVE-2020-9916) was discovered that affected multiple Apple products including iOS 13.6, iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, and iCloud for Windows 7.20. The vulnerability was discovered by Rakesh Mane (@RakeshMane10) and was fixed in July 2020 through various software updates (Apple Support).

The vulnerability was identified as a URL Unicode encoding issue in the WebKit Page Loading component. The issue stemmed from improper state management in URL handling. The vulnerability received a CVSS v3.1 base score of 5.3 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating it was network accessible, required low attack complexity, and could impact integrity (NVD).

When exploited, this vulnerability could allow a malicious attacker to conceal the destination of a URL, potentially enabling phishing attacks or other forms of deception by hiding the true destination of links presented to users (Apple Support).

The vulnerability requires no user interaction and can be exploited remotely by an attacker who can trick a user into visiting a maliciously crafted webpage. The attack vector is network-based, making it accessible to remote attackers (NVD).

Apple addressed this vulnerability by improving state management in the URL Unicode encoding system. Users should update to iOS 13.6, iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, or iCloud for Windows 7.20, depending on their device (Apple Support).