#VU17438 Path traversal in Shortcuts for iOS - CVE-2019-7289

Vulnerability identifier: #VU17438

Vulnerability risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-7289

CWE-ID: CWE-22

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Shortcuts for iOS
Client/Desktop applications / Software for system administration

Vendor: Apple Inc.

Description
The vulnerability allows a local attacker to obtain potentially sensitive information on the target system.

The weakness exists due to an error in Shortcuts during improper handling of directory paths. A local attacker can conduct directory traversal attack and view sensitive user information.

Mitigation
Update to version 2.1.3.

Vulnerable software versions

Shortcuts for iOS: 2.1.2

---

External links
https://support.apple.com/en-us/HT209522

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.