Wednesday, June 12, 2024

Apple Reportedly Patches XSS Vulnerability on iCloud’s Website

Share

In a blog post shared by ZDNet, security researcher Vishal Bharad claims that he found a bug that would have allowed a hacker to inject a virus or malicious script onto Apple’s ‌iCloud‌ website.

According to Bharad, the vulnerability consisted of creating a Pages or Keynote document on the ‌iCloud‌ website with the name field containing the XSS payload. Sharing the document with another user, creating a change, saving, and then clicking “Browse All Versions” under Settings would have triggered the XSS payload.

Given the vulnerability revolved around the ‌iCloud‌ website, it’s not linked to a recent software update and has reportedly been patched by Apple server-side. Bharad says he submitted the issue to Apple on August 7, 2020, and received a $5,000 bounty on October 9, 2020. We’ve reached out to Apple for comment and we’ll update if we hear back.Tags: security, iCloud
This article, “Apple Reportedly Patches XSS Vulnerability on iCloud’s Website” first appeared on MacRumors.com

Discuss this article in our forums

MacRumors-All?d=6W8y8wAjSf4 MacRumors-All?d=qj6IDK7rITs

Read more

More News