CVE Vulnerabilities

CVE-2018-4190

Insufficiently Protected Credentials

Published: Jun 08, 2018 | Modified: Nov 21, 2024
CVSS 3.x
8.8
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the WebKit component. It allows remote attackers to obtain sensitive credential information that is transmitted during a CSS mask-image fetch.

Weakness

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Affected Software

Name Vendor Start Version End Version
Safari Apple * 11.1.1 (excluding)
Iphone_os Apple * 11.4 (excluding)
Tvos Apple * 11.4 (excluding)
Qtwebkit Ubuntu eoan *
Qtwebkit-opensource-src Ubuntu artful *
Qtwebkit-opensource-src Ubuntu bionic *
Qtwebkit-opensource-src Ubuntu cosmic *
Qtwebkit-opensource-src Ubuntu devel *
Qtwebkit-opensource-src Ubuntu disco *
Qtwebkit-opensource-src Ubuntu eoan *
Qtwebkit-opensource-src Ubuntu esm-apps/bionic *
Qtwebkit-opensource-src Ubuntu esm-apps/focal *
Qtwebkit-opensource-src Ubuntu esm-apps/jammy *
Qtwebkit-opensource-src Ubuntu esm-apps/noble *
Qtwebkit-opensource-src Ubuntu esm-infra/xenial *
Qtwebkit-opensource-src Ubuntu focal *
Qtwebkit-opensource-src Ubuntu groovy *
Qtwebkit-opensource-src Ubuntu hirsute *
Qtwebkit-opensource-src Ubuntu impish *
Qtwebkit-opensource-src Ubuntu jammy *
Qtwebkit-opensource-src Ubuntu kinetic *
Qtwebkit-opensource-src Ubuntu lunar *
Qtwebkit-opensource-src Ubuntu mantic *
Qtwebkit-opensource-src Ubuntu noble *
Qtwebkit-opensource-src Ubuntu trusty *
Qtwebkit-opensource-src Ubuntu upstream *
Qtwebkit-opensource-src Ubuntu xenial *
Qtwebkit-source Ubuntu artful *
Qtwebkit-source Ubuntu bionic *
Qtwebkit-source Ubuntu cosmic *
Qtwebkit-source Ubuntu disco *
Qtwebkit-source Ubuntu esm-apps/bionic *
Qtwebkit-source Ubuntu esm-apps/xenial *
Qtwebkit-source Ubuntu trusty *
Qtwebkit-source Ubuntu xenial *
Webkit2gtk Ubuntu artful *
Webkit2gtk Ubuntu bionic *
Webkit2gtk Ubuntu upstream *
Webkit2gtk Ubuntu xenial *
Webkitgtk Ubuntu artful *
Webkitgtk Ubuntu bionic *
Webkitgtk Ubuntu cosmic *
Webkitgtk Ubuntu esm-apps/bionic *
Webkitgtk Ubuntu esm-apps/xenial *
Webkitgtk Ubuntu trusty *
Webkitgtk Ubuntu xenial *

Potential Mitigations

References