{"api_version":"1","generated_at":"2026-07-23T06:41:50+00:00","cve":"CVE-2018-4168","urls":{"html":"https://cve.report/CVE-2018-4168","api":"https://cve.report/api/cve/CVE-2018-4168.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-4168","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-4168"},"summary":{"title":"CVE-2018-4168","description":"An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the \"Files Widget\" component. It allows physically proximate attackers to obtain sensitive information by leveraging the display of cached data on a locked device.","state":"PUBLIC","assigner":"product-security@apple.com","published_at":"2018-04-03 06:29:00","updated_at":"2018-05-04 14:37:00"},"problem_types":["CWE-200"],"metrics":[],"references":[{"url":"https://support.apple.com/HT208693","name":"https://support.apple.com/HT208693","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"About the security content of iOS 11.3 - Apple Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/103578","name":"103578","refsource":"BID","tags":["Third Party Advisory","VDB Entry"],"title":"Apple iOS APPLE-SA-2018-3-29-1 Multiple Security Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.securitytracker.com/id/1040604","name":"1040604","refsource":"SECTRACK","tags":["Third Party Advisory","VDB Entry"],"title":"Apple iOS Multiple Flaws Let Remote Users Execute Arbitrary Code, Deny Service, and Spoof the User Interface, Remote and Local Users Bypass Security Restrictions and Obtain Potentially Sensitive Information, and Let Applications Gain Elevated Privileges - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-4168","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-4168","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"4168","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"apple","cpe5":"iphone_os","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"4168","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"apple","cpe5":"iphone_os","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"product-security@apple.com","ID":"CVE-2018-4168","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the \"Files Widget\" component. It allows physically proximate attackers to obtain sensitive information by leveraging the display of cached data on a locked device."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"1040604","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1040604"},{"name":"https://support.apple.com/HT208693","refsource":"CONFIRM","url":"https://support.apple.com/HT208693"},{"name":"103578","refsource":"BID","url":"http://www.securityfocus.com/bid/103578"}]}},"nvd":{"publishedDate":"2018-04-03 06:29:00","lastModifiedDate":"2018-05-04 14:37:00","problem_types":["CWE-200"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4.6,"baseSeverity":"MEDIUM"},"exploitabilityScore":0.9,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:N/A:N","accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":2.1},"severity":"LOW","exploitabilityScore":3.9,"impactScore":2.9,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionEndExcluding":"11.3","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"4168","Ordinal":"120082","Title":"CVE-2018-4168","CVE":"CVE-2018-4168","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"4168","Ordinal":"1","NoteData":"An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the \"Files Widget\" component. It allows physically proximate attackers to obtain sensitive information by leveraging the display of cached data on a locked device.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"4168","Ordinal":"2","NoteData":"2018-04-03","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"4168","Ordinal":"3","NoteData":"2018-04-03","Type":"Other","Title":"Modified"}]}}}