Information Disclosure Vulnerability in iTunes by Apple
CVE-2020-27895

3.3LOW

Key Information:

Vendor

Apple
Status
Itunes For Windows
Vendor
CVE Published:
8 December 2020

What is CVE-2020-27895?

An information disclosure vulnerability has been identified in iTunes that pertains to the improper handling of program state transitions. This flaw may allow a malicious application to exploit the issue and gain unauthorized access to local users' Apple IDs on affected systems. Apple has addressed this security issue by implementing improved state handling in the latest release of iTunes, specifically version 12.11 for Windows.

Affected Version(s)

iTunes for Windows < 12.11

References

https://support.apple.com/en-us/HT211933
x_refsource_MISC

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.