TI-2020-08018 Aliases CVE-2020-9945 GHSA-vv27-2433-5mq8

Clickjacking in Apple macOS

LOW 22CWE-1021Published 2020-12-08 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-1021.

Summary

A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, Safari 14.0.1. Visiting a malicious website may lead to address bar spoofing.

Why it matters now

EPSS 0.01177 67th percentileScored 2026-11-07

Fix Fixed macOS (Apple): 11.0, 14.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apple	macOS	before 11.0	11.0	Patch available	CNA
Apple	macOS	before 14.0	14.0	Patch available	CNA

macOS VendorApple Affected before 11.0 Fixed in 11.0 Patch available CNA
macOS VendorApple Affected before 14.0 Fixed in 14.0 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:apple:safari::::::::	before 14.0.1	Vulnerable	Apple
cpe:2.3:o:apple:mac_os_x::::::::	before 11.0.1	Vulnerable	Apple

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* Versions before 14.0.1 Vulnerable ·Apple
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* Versions before 11.0.1 Vulnerable ·Apple

Remediation

Fix · CNA macOS (Apple) Fixed in 11.0
Fix · CNA macOS (Apple) Fixed in 14.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2020-12-08
Apple macOS 11.0
45 records Highest priority Priority CRITICAL 2 CRITICAL, 1 HIGH, 4 MEDIUM, 38 LOW
Other records, highest priority first
- TI-2020-16987 Type confusion in Apple watchOSPriority CRITICAL 93
- TI-2020-16985 Out-of-bounds write in Apple watchOSPriority CRITICAL 93
- TI-2020-17004 Apple watchOS: A malicious application may be able to disclose kernel memoryPriority HIGH 82
Show all 45 records →
Release · 2020-12-08
Apple macOS 14.0
5 records Highest priority Priority LOW 5 LOW
Other records, highest priority first
- TI-2020-16974 Use after free in Apple watchOSPriority LOW 37
- TI-2020-08051 Use after free in Apple tvOSPriority LOW 37
- TI-2020-08026 Buffer overflow in Apple tvOSPriority LOW 37
Show all 5 records →

Timeline

2026-10-02 Threatist record created from CVE-2020-9945
2026-10-03 Alias added: GHSA-vv27-2433-5mq8

References

Advisory 3

TI-2021-01573 Apple iOS and iPadOS: A remote attacker may be able to cause arbitrary code execution KEVCVSS 3.1CRITICAL 9.8
TI-2021-01572 Apple iOS and iPadOS: A remote attacker may be able to cause arbitrary code execution KEVCVSS 3.1CRITICAL 9.8
TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
TI-2012-01607 sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI… KEVCVSS 3.1CRITICAL 9.8
TI-2022-02117 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8

See all 3209 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences