{"api_version":"1","generated_at":"2026-07-23T04:36:05+00:00","cve":"CVE-2017-2499","urls":{"html":"https://cve.report/CVE-2017-2499","api":"https://cve.report/api/cve/CVE-2017-2499.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-2499","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-2499"},"summary":{"title":"CVE-2017-2499","description":"An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the \"WebKit Web Inspector\" component. It allows attackers to execute arbitrary unsigned code or cause a denial of service (memory corruption) via a crafted app.","state":"PUBLISHED","assigner":"apple","published_at":"2017-05-22 05:29:00","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-119","n/a"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"7.8","severity":"HIGH","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.8","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.securitytracker.com/id/1038487","name":"http://www.securitytracker.com/id/1038487","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Apple Safari Multiple Bugs Let Remote Users Deny Service, Conduct Cross-Site Scripting Attacks, Spoof URLs, and Execute Arbitrary Code and Let Applications Bypass Code Signing Policy - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://support.apple.com/HT207804","name":"https://support.apple.com/HT207804","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"About the security content of Safari 10.1.1 - Apple Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/98473","name":"http://www.securityfocus.com/bid/98473","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Webkit Cross Site Scripting and Arbitrary Code Execution Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://support.apple.com/HT207798","name":"https://support.apple.com/HT207798","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"About the security content of iOS 10.3.2 - Apple Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://support.apple.com/HT207801","name":"https://support.apple.com/HT207801","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"About the security content of tvOS 10.2.1 - Apple Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2499","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2499","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"2499","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"apple","cpe5":"iphone_os","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"2499","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apple","cpe5":"safari","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"2499","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"apple","cpe5":"tvos","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T13:55:06.128Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"1038487","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1038487"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://support.apple.com/HT207804"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://support.apple.com/HT207798"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://support.apple.com/HT207801"},{"name":"98473","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/98473"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2017-05-15T00:00:00.000Z","descriptions":[{"lang":"en","value":"An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the \"WebKit Web Inspector\" component. It allows attackers to execute arbitrary unsigned code or cause a denial of service (memory corruption) via a crafted app."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-07T09:57:01.000Z","orgId":"286789f9-fbc2-4510-9f9a-43facdede74c","shortName":"apple"},"references":[{"name":"1038487","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1038487"},{"tags":["x_refsource_CONFIRM"],"url":"https://support.apple.com/HT207804"},{"tags":["x_refsource_CONFIRM"],"url":"https://support.apple.com/HT207798"},{"tags":["x_refsource_CONFIRM"],"url":"https://support.apple.com/HT207801"},{"name":"98473","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/98473"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"product-security@apple.com","ID":"CVE-2017-2499","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the \"WebKit Web Inspector\" component. It allows attackers to execute arbitrary unsigned code or cause a denial of service (memory corruption) via a crafted app."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"1038487","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1038487"},{"name":"https://support.apple.com/HT207804","refsource":"CONFIRM","url":"https://support.apple.com/HT207804"},{"name":"https://support.apple.com/HT207798","refsource":"CONFIRM","url":"https://support.apple.com/HT207798"},{"name":"https://support.apple.com/HT207801","refsource":"CONFIRM","url":"https://support.apple.com/HT207801"},{"name":"98473","refsource":"BID","url":"http://www.securityfocus.com/bid/98473"}]}}}},"cveMetadata":{"assignerOrgId":"286789f9-fbc2-4510-9f9a-43facdede74c","assignerShortName":"apple","cveId":"CVE-2017-2499","datePublished":"2017-05-22T04:54:00.000Z","dateReserved":"2016-12-01T00:00:00.000Z","dateUpdated":"2024-08-05T13:55:06.128Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-05-22 05:29:00","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-119","n/a"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*","versionEndExcluding":"10.1.1","matchCriteriaId":"E41B300D-8147-46F8-A0F7-EDFD2B0D8613"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionEndExcluding":"10.3.2","matchCriteriaId":"708FF05D-EDB2-4CE2-B689-F79A0A80CAF2"},{"vulnerable":true,"criteria":"cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*","versionEndExcluding":"10.2.1","matchCriteriaId":"5118C36B-1C20-4481-8207-0E4435D60DAA"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"2499","Ordinal":"1","Title":"CVE-2017-2499","CVE":"CVE-2017-2499","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"2499","Ordinal":"1","NoteData":"An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the \"WebKit Web Inspector\" component. It allows attackers to execute arbitrary unsigned code or cause a denial of service (memory corruption) via a crafted app.","Type":"Description","Title":"CVE-2017-2499"},{"CveYear":"2017","CveId":"2499","Ordinal":"2","NoteData":"2017-05-22","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"2499","Ordinal":"3","NoteData":"2017-07-07","Type":"Other","Title":"Modified"}]}}}