Medium severity6.1NVD Advisory· Published Feb 27, 2020· Updated Jun 17, 2026

CVE-2020-3867

Description

A logic issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for Windows 7.17. Processing maliciously crafted web content may lead to universal cross site scripting.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Apple Inc./tvOSllm-fuzzy3 versions
=13.3.1+ 2 more
- (no CPE)range: =13.3.1
- (no CPE)range: unspecified
- cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*range: <13.3.1
Apple Inc./iOSllm-fuzzy2 versions
=13.3.1+ 1 more
- (no CPE)range: =13.3.1
- (no CPE)range: unspecified
Apple Inc./Ipadosllm-fuzzy2 versions
=13.3.1+ 1 more
- (no CPE)range: =13.3.1
- cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*range: <13.3.1
Apple Inc./iTunes for Windowsllm-fuzzy2 versions
=12.10.4+ 1 more
- (no CPE)range: =12.10.4
- (no CPE)range: unspecified
Apple Inc./Safarillm-fuzzy3 versions
=13.0.5+ 2 more
- (no CPE)range: =13.0.5
- (no CPE)range: unspecified
- cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*range: <13.0.5
Apple Inc./iCloud for Windowsllm-fuzzy3 versions
=11.0+ 2 more
- (no CPE)range: =11.0
- (no CPE)range: unspecified
- (no CPE)range: unspecified
osv-coords66 versions
pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015 pkg:rpm/suse/webkit2gtk3&distro=SUSE%20OpenStack%20Cloud%207 pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/opensuse/gtk3&distro=openSUSE%20Tumbleweed pkg:rpm/almalinux/LibRaw-devel pkg:rpm/almalinux/PackageKit-command-not-found pkg:rpm/almalinux/dleyna-renderer pkg:rpm/almalinux/frei0r-devel pkg:rpm/almalinux/frei0r-plugins pkg:rpm/almalinux/libsoup pkg:rpm/almalinux/libsoup-devel pkg:rpm/almalinux/mutter-devel pkg:rpm/almalinux/nautilus pkg:rpm/almalinux/nautilus-devel pkg:rpm/almalinux/pipewire pkg:rpm/almalinux/pipewire-devel pkg:rpm/almalinux/pipewire-doc pkg:rpm/almalinux/pipewire-libs pkg:rpm/almalinux/pipewire-utils pkg:rpm/almalinux/pipewire0.2-devel pkg:rpm/almalinux/pipewire0.2-libs pkg:rpm/almalinux/potrace pkg:rpm/almalinux/pygobject3-devel pkg:rpm/almalinux/python3-gobject pkg:rpm/almalinux/python3-gobject-base pkg:rpm/almalinux/tracker pkg:rpm/almalinux/tracker-devel pkg:rpm/almalinux/vte-profile pkg:rpm/almalinux/vte291 pkg:rpm/almalinux/vte291-devel pkg:rpm/almalinux/webrtc-audio-processing pkg:rpm/almalinux/xdg-desktop-portal-gtk pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOS pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSS pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSS pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Enterprise%20Storage%205 pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015 pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP1 pkg:rpm/suse/webkit2gtk3&distro=HPE%20Helion%20OpenStack%208 pkg:rpm/suse/webkit2gtk3&distro=SUSE%20OpenStack%20Cloud%208 pkg:rpm/suse/webkit2gtk3&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208 pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCL pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4 pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5 pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5 pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2012%20SP4 pkg:rpm/almalinux/PackageKit pkg:rpm/almalinux/PackageKit-cron pkg:rpm/almalinux/PackageKit-glib pkg:rpm/almalinux/PackageKit-glib-devel pkg:rpm/almalinux/PackageKit-gstreamer-plugin pkg:rpm/almalinux/PackageKit-gtk3-module pkg:rpm/almalinux/frei0r-plugins-opencv pkg:rpm/almalinux/gnome-remote-desktop pkg:rpm/almalinux/gtk-doc pkg:rpm/almalinux/gvfs pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSS pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/webkit2gtk3&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1 pkg:rpm/opensuse/webkit2gtk3&distro=openSUSE%20Leap%2015.1
< 2.26.4-3.43.1+ 65 more
- (no CPE)range: < 2.26.4-3.43.1
- (no CPE)range: < 2.28.1-2.50.3
- (no CPE)range: < 2.28.1-2.50.3
- (no CPE)range: < 2.32.4-1.1
- (no CPE)range: < 0.19.5-2.el8
- (no CPE)range: < 1.1.12-6.el8
- (no CPE)range: < 0.6.0-3.el8
- (no CPE)range: < 1.6.1-7.el8
- (no CPE)range: < 1.6.1-7.el8
- (no CPE)range: < 2.62.3-2.el8
- (no CPE)range: < 2.62.3-2.el8
- (no CPE)range: < 3.32.2-48.el8
- (no CPE)range: < 3.28.1-14.el8
- (no CPE)range: < 3.28.1-14.el8
- (no CPE)range: < 0.3.6-1.el8
- (no CPE)range: < 0.3.6-1.el8
- (no CPE)range: < 0.3.6-1.el8
- (no CPE)range: < 0.3.6-1.el8
- (no CPE)range: < 0.3.6-1.el8
- (no CPE)range: < 0.2.7-6.el8
- (no CPE)range: < 0.2.7-6.el8
- (no CPE)range: < 1.15-3.el8
- (no CPE)range: < 3.28.3-2.el8
- (no CPE)range: < 3.28.3-2.el8
- (no CPE)range: < 3.28.3-2.el8
- (no CPE)range: < 2.1.5-2.el8
- (no CPE)range: < 2.1.5-2.el8
- (no CPE)range: < 0.52.4-2.el8
- (no CPE)range: < 0.52.4-2.el8
- (no CPE)range: < 0.52.4-2.el8
- (no CPE)range: < 0.3-9.el8
- (no CPE)range: < 1.6.0-1.el8
- (no CPE)range: < 2.26.4-3.43.1
- (no CPE)range: < 2.26.4-3.43.1
- (no CPE)range: < 2.26.4-3.43.1
- (no CPE)range: < 2.28.1-2.50.3
- (no CPE)range: < 2.26.4-3.43.1
- (no CPE)range: < 2.26.4-3.43.1
- (no CPE)range: < 2.28.1-2.50.3
- (no CPE)range: < 2.28.1-2.50.3
- (no CPE)range: < 2.28.1-2.50.3
- (no CPE)range: < 2.28.1-2.50.3
- (no CPE)range: < 2.28.1-2.50.3
- (no CPE)range: < 2.28.1-2.50.3
- (no CPE)range: < 2.28.1-2.50.3
- (no CPE)range: < 2.28.1-2.50.3
- (no CPE)range: < 2.28.1-2.50.3
- (no CPE)range: < 2.28.1-2.50.3
- (no CPE)range: < 2.28.1-2.50.3
- (no CPE)range: < 2.28.1-2.50.3
- (no CPE)range: < 2.28.1-2.50.3
- (no CPE)range: < 2.28.1-2.50.3
- (no CPE)range: < 1.1.12-6.el8
- (no CPE)range: < 1.1.12-6.el8
- (no CPE)range: < 1.1.12-6.el8
- (no CPE)range: < 1.1.12-6.el8
- (no CPE)range: < 1.1.12-6.el8
- (no CPE)range: < 1.1.12-6.el8
- (no CPE)range: < 1.6.1-7.el8
- (no CPE)range: < 0.1.8-3.el8
- (no CPE)range: < 1.28-2.el8
- (no CPE)range: < 1.36.2-10.el8
- (no CPE)range: < 2.28.1-2.50.3
- (no CPE)range: < 2.26.4-3.43.1
- (no CPE)range: < 2.26.4-3.43.1
- (no CPE)range: < 2.26.4-lp151.2.12.1
Apple Inc./iCloud
cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*
Range: <7.17
Apple Inc./iTunes
cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:*
Range: <12.10.4
Apple Inc./Iphone OS
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Range: <13.3.1
OpenSUSE/Leap
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Webkitgtk/Webkitgtk
cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*
Range: <2.26.4

Patches

Vulnerability mechanics

References

lists.opensuse.org/opensuse-security-announce/2020-03/msg00004.htmlnvdMailing ListPatchThird Party Advisory
security.gentoo.org/glsa/202003-22nvdThird Party Advisory
support.apple.com/HT210947nvdRelease NotesVendor Advisory
support.apple.com/HT210948nvdRelease NotesVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000