CVE-2017-7109

6.1 mediumEPSS 1.0%

An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via crafted web content that incorrectly interacts with the Application Cache policy.

Severity

CVSS 3.0

6.1 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2017-10-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apple:icloud
apple:iphone_os
apple:itunes
apple:safari
apple:tvos

References

http://www.securityfocus.com/bid/101005
http://www.securitytracker.com/id/1039384
http://www.securitytracker.com/id/1039428
https://support.apple.com/HT208112
https://support.apple.com/HT208113

Check your stack JSON