CVE-2020-9945

A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in macOS…

4.3MediumCVSS base score
1.2%Exploitation in 30 daysEPSS · top 32% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, Safari 14.0.1. Visiting a malicious website may lead to address bar spoofing.

Timeline

2020
2 Mar 2020
2 Mar 2020
ID reserved
By apple
8 Dec 20209 months later
8 Dec 2020· 9 months later
Published
2024
4 Aug 20244 years later
4 Aug 2024· 4 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2020-9945, by who scored it
Scored by	CVSS	Score	Vector
NVDNVD · Modified	3.1	Medium4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS (exploitation in 30 days): 1.2% · top 32% of all CVEs (11 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Affected products

Apple · macOS
- affected unspecified – < 11.0
Apple · macOS
- affected unspecified – < 14.0

References3

https://support.apple.com/en-us/HT211931 (opens in a new tab)x_refsource_MISCx_transferred
https://support.apple.com/en-us/HT211934 (opens in a new tab)x_refsource_MISCx_transferred
20201215 APPLE-SA-2020-12-14-4 Additional information for APPLE-SA-2020-11-13-1 macOS Big Sur 11.0.1 (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2020-9945](https://cveledger.app/badge/CVE-2020-9945.svg)](https://cveledger.app/cve/CVE-2020-9945)

Record last updated 4 Aug 2024, 10:50 UTC.