Insecure Data Transmission in iOS Affecting Exchange Rates from Apple
CVE-2017-2411

5.9MEDIUM

Key Information:

Vendor

Apple
Status
iPhone OS
Vendor
CVE Published:
11 January 2019

What is CVE-2017-2411?

The vulnerability arises from the use of HTTP instead of HTTPS for retrieving exchange rates in iOS versions prior to 11.2. This insecure data transmission allows potential interception of sensitive data, putting users at risk. The issue was mitigated by mandating the use of HTTPS for fetching exchange rates, thereby enhancing the overall security posture of the affected devices.

References

https://support.apple.com/HT208334
x_refsource_CONFIRM

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2017-2411 : Insecure Data Transmission in iOS Affecting Exchange Rates from Apple